Improve PCIe inventory and hardware identity collection

- New tui/sat_progress.go: polls {DefaultSATBaseDir}/{prefix}-*/verbose.log every 300ms and parses completed/in-progress steps
  - Busy screen now shows each step as PASS  lscpu (234ms) / FAIL  stress-ng (60.0s) / ...   sensors-after instead of just "Working..."

  2. Test results shown on screen (instead of just "Archive written to /path")
  - RunCPUAcceptancePackResult, RunMemoryAcceptancePackResult, RunStorageAcceptancePackResult, RunAMDAcceptancePackResult now read summary.txt from the run directory and return a formatted per-step result:
  Run: 2025-03-25T10:00:00Z

  PASS  lscpu
  PASS  sensors-before
  FAIL  stress-ng
  PASS  sensors-after

  Overall: FAILED  (ok=3  failed=1)

  3. AMD GPU SAT with auto-detection
  - platform.System.DetectGPUVendor(): checks /dev/nvidia0 → "nvidia", /dev/kfd → "amd"
  - platform.System.RunAMDAcceptancePack(): runs rocm-smi, rocm-smi --showallinfo, dmidecode
  - GPU SAT (G key / GPU row enter) automatically routes to AMD or NVIDIA based on detected vendor
  - "Run All" also auto-detects vendor

  4. Panel detail view
  - GPU detail now shows the most recent (NVIDIA or AMD) SAT result, whichever is newer
  - All SAT detail views use the same human-readable formatSATDetail format

.gitmodules

@@ -1,3 +1,6 @@
 [submodule "bible"]
 	path = bible
 	url = https://git.mchus.pro/mchus/bible.git
+[submodule "internal/chart"]
+	path = internal/chart
+	url = https://git.mchus.pro/reanimator/chart.git

PLAN.md

@@ -272,13 +272,10 @@ ISO image bootable via BMC virtual media or USB. Runs boot services automaticall
 
 ### 2.1 — Builder environment
 
-`iso/builder/setup-builder.sh` prepares a Debian 12 host/VM with:
-- `live-build`, `debootstrap`, bootloader tooling, kernel headers
-- Go toolchain
-- everything needed to compile the `bee` binary and NVIDIA modules
-
-`iso/builder/build-in-container.sh` offers the same builder stack in a Debian 12 container image.
-The container run is privileged because `live-build` needs mount/chroot/loop capabilities.
+`iso/builder/build-in-container.sh` is the only supported builder entrypoint.
+It builds a Debian 12 builder image with `live-build`, toolchains, and pinned kernel headers,
+then runs the ISO assembly in a privileged container because `live-build` needs
+mount/chroot/loop capabilities.
 
 `iso/builder/build.sh` orchestrates the full ISO build:
 1. compile the Go `bee` binary
@@ -392,7 +389,7 @@ No "works on my Mac" drift.
 
 --- BUILDER + BEE ISO (unblock real-hardware testing) ---
 
-2.1  builder setup                 → Debian host/VM or privileged container with build deps
+2.1  builder setup                 → privileged container with build deps
 2.2  debug ISO profile             → minimal Debian ISO: `bee` binary + OpenSSH + all packages
 2.3  boot on real server           → SSH in, verify packages present, run audit manually
 

audit/cmd/bee/main.go

@@ -12,6 +12,7 @@ import (
 	"bee/audit/internal/platform"
 	"bee/audit/internal/runtimeenv"
 	"bee/audit/internal/tui"
+	"bee/audit/internal/webui"
 )
 
 var Version = "dev"
@@ -43,6 +44,12 @@ func run(args []string, stdout, stderr io.Writer) int {
 		return runTUI(args[1:], stdout, stderr)
 	case "export":
 		return runExport(args[1:], stdout, stderr)
+	case "preflight":
+		return runPreflight(args[1:], stdout, stderr)
+	case "support-bundle":
+		return runSupportBundle(args[1:], stdout, stderr)
+	case "web":
+		return runWeb(args[1:], stdout, stderr)
 	case "sat":
 		return runSAT(args[1:], stdout, stderr)
 	case "version", "--version", "-version":
@@ -58,9 +65,12 @@ func run(args []string, stdout, stderr io.Writer) int {
 func printRootUsage(w io.Writer) {
 	fmt.Fprintln(w, `bee commands:
   bee audit   --runtime auto|local|livecd --output stdout|file:<path>
+  bee preflight --output stdout|file:<path>
   bee tui     --runtime auto|local|livecd
   bee export  --target <device>
-  bee sat nvidia|memory|storage
+  bee support-bundle --output stdout|file:<path>
+  bee web     --listen :80 --audit-path `+app.DefaultAuditJSONPath+`
+  bee sat nvidia|memory|storage|cpu [--duration <seconds>]
   bee version
   bee help [command]`)
 }
@@ -73,6 +83,12 @@ func runHelp(args []string, stdout, stderr io.Writer) int {
 		return runTUI([]string{"--help"}, stdout, stdout)
 	case "export":
 		return runExport([]string{"--help"}, stdout, stdout)
+	case "preflight":
+		return runPreflight([]string{"--help"}, stdout, stdout)
+	case "support-bundle":
+		return runSupportBundle([]string{"--help"}, stdout, stdout)
+	case "web":
+		return runWeb([]string{"--help"}, stdout, stdout)
 	case "sat":
 		return runSAT([]string{"--help"}, stdout, stderr)
 	case "version":
@@ -213,45 +229,175 @@ func runExport(args []string, stdout, stderr io.Writer) int {
 	return 1
 }
 
+func runPreflight(args []string, stdout, stderr io.Writer) int {
+	fs := flag.NewFlagSet("preflight", flag.ContinueOnError)
+	fs.SetOutput(stderr)
+	output := fs.String("output", "stdout", "output destination: stdout or file:<path>")
+	fs.Usage = func() {
+		fmt.Fprintf(stderr, "usage: bee preflight [--output stdout|file:%s]\n", app.DefaultRuntimeJSONPath)
+		fs.PrintDefaults()
+	}
+	if err := fs.Parse(args); err != nil {
+		if err == flag.ErrHelp {
+			return 0
+		}
+		return 2
+	}
+	if fs.NArg() != 0 {
+		fs.Usage()
+		return 2
+	}
+	application := app.New(platform.New())
+	path, err := application.RunRuntimePreflight(*output)
+	if err != nil {
+		slog.Error("run preflight", "err", err)
+		return 1
+	}
+	if path != "stdout" {
+		slog.Info("runtime health written", "path", path)
+	}
+	return 0
+}
+
+func runSupportBundle(args []string, stdout, stderr io.Writer) int {
+	fs := flag.NewFlagSet("support-bundle", flag.ContinueOnError)
+	fs.SetOutput(stderr)
+	output := fs.String("output", "stdout", "output destination: stdout or file:<path>")
+	fs.Usage = func() {
+		fmt.Fprintln(stderr, "usage: bee support-bundle [--output stdout|file:<path>]")
+		fs.PrintDefaults()
+	}
+	if err := fs.Parse(args); err != nil {
+		if err == flag.ErrHelp {
+			return 0
+		}
+		return 2
+	}
+	if fs.NArg() != 0 {
+		fs.Usage()
+		return 2
+	}
+	path, err := app.BuildSupportBundle(app.DefaultExportDir)
+	if err != nil {
+		slog.Error("build support bundle", "err", err)
+		return 1
+	}
+	defer os.Remove(path)
+
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		slog.Error("read support bundle", "err", err)
+		return 1
+	}
+	switch {
+	case *output == "stdout":
+		if _, err := stdout.Write(raw); err != nil {
+			slog.Error("write support bundle stdout", "err", err)
+			return 1
+		}
+	case strings.HasPrefix(*output, "file:"):
+		dst := strings.TrimPrefix(*output, "file:")
+		if err := os.WriteFile(dst, raw, 0644); err != nil {
+			slog.Error("write support bundle", "err", err)
+			return 1
+		}
+		slog.Info("support bundle written", "path", dst)
+	default:
+		fmt.Fprintln(stderr, "bee support-bundle: unknown output destination")
+		fs.Usage()
+		return 2
+	}
+	return 0
+}
+
+func runWeb(args []string, stdout, stderr io.Writer) int {
+	fs := flag.NewFlagSet("web", flag.ContinueOnError)
+	fs.SetOutput(stderr)
+	listenAddr := fs.String("listen", ":8080", "listen address, e.g. :80")
+	auditPath := fs.String("audit-path", app.DefaultAuditJSONPath, "path to the latest audit JSON snapshot")
+	exportDir := fs.String("export-dir", app.DefaultExportDir, "directory with logs, SAT results, and support bundles")
+	title := fs.String("title", "Bee Hardware Audit", "page title")
+	fs.Usage = func() {
+		fmt.Fprintf(stderr, "usage: bee web [--listen :80] [--audit-path %s] [--export-dir %s] [--title \"Bee Hardware Audit\"]\n", app.DefaultAuditJSONPath, app.DefaultExportDir)
+		fs.PrintDefaults()
+	}
+	if err := fs.Parse(args); err != nil {
+		if err == flag.ErrHelp {
+			return 0
+		}
+		return 2
+	}
+	if fs.NArg() != 0 {
+		fs.Usage()
+		return 2
+	}
+
+	slog.Info("starting bee web", "listen", *listenAddr, "audit_path", *auditPath)
+	if err := webui.ListenAndServe(*listenAddr, webui.HandlerOptions{
+		Title:     *title,
+		AuditPath: *auditPath,
+		ExportDir: *exportDir,
+	}); err != nil {
+		slog.Error("run web", "err", err)
+		return 1
+	}
+	return 0
+}
+
 func runSAT(args []string, stdout, stderr io.Writer) int {
 	if len(args) == 0 {
-		fmt.Fprintln(stderr, "usage: bee sat nvidia|memory|storage")
+		fmt.Fprintln(stderr, "usage: bee sat nvidia|memory|storage|cpu [--duration <seconds>]")
 		return 2
 	}
 	if args[0] == "help" || args[0] == "--help" || args[0] == "-h" {
-		fmt.Fprintln(stdout, "usage: bee sat nvidia|memory|storage")
+		fmt.Fprintln(stdout, "usage: bee sat nvidia|memory|storage|cpu [--duration <seconds>]")
 		return 0
 	}
-	if args[0] != "nvidia" && args[0] != "memory" && args[0] != "storage" {
-		fmt.Fprintf(stderr, "bee sat: unknown target %q\n", args[0])
-		fmt.Fprintln(stderr, "usage: bee sat nvidia|memory|storage")
+
+	fs := flag.NewFlagSet("sat", flag.ContinueOnError)
+	fs.SetOutput(stderr)
+	duration := fs.Int("duration", 0, "stress-ng duration in seconds (cpu only; default: 60)")
+	if err := fs.Parse(args[1:]); err != nil {
+		if err == flag.ErrHelp {
+			return 0
+		}
 		return 2
 	}
-	if len(args) > 1 {
-		fmt.Fprintln(stderr, "usage: bee sat nvidia|memory|storage")
+	if fs.NArg() != 0 {
+		fmt.Fprintf(stderr, "bee sat: unexpected arguments\n")
 		return 2
 	}
+
+	target := args[0]
+	if target != "nvidia" && target != "memory" && target != "storage" && target != "cpu" {
+		fmt.Fprintf(stderr, "bee sat: unknown target %q\n", target)
+		fmt.Fprintln(stderr, "usage: bee sat nvidia|memory|storage|cpu [--duration <seconds>]")
+		return 2
+	}
+
 	application := app.New(platform.New())
 	var (
 		archive string
 		err     error
-		label   string
 	)
-	switch args[0] {
+	switch target {
 	case "nvidia":
-		label = "nvidia"
 		archive, err = application.RunNvidiaAcceptancePack("")
 	case "memory":
-		label = "memory"
 		archive, err = application.RunMemoryAcceptancePack("")
 	case "storage":
-		label = "storage"
 		archive, err = application.RunStorageAcceptancePack("")
+	case "cpu":
+		dur := *duration
+		if dur <= 0 {
+			dur = 60
+		}
+		archive, err = application.RunCPUAcceptancePack("", dur)
 	}
 	if err != nil {
-		slog.Error("run sat", "target", label, "err", err)
+		slog.Error("run sat", "target", target, "err", err)
 		return 1
 	}
-	slog.Info("sat archive written", "target", label, "path", archive)
+	slog.Info("sat archive written", "target", target, "path", archive)
 	return 0
 }

audit/cmd/bee/main_test.go

@@ -91,6 +91,32 @@ func TestRunSATUsage(t *testing.T) {
 	}
 }
 
+func TestRunPreflightRejectsExtraArgs(t *testing.T) {
+	t.Parallel()
+
+	var stdout, stderr bytes.Buffer
+	rc := run([]string{"preflight", "extra"}, &stdout, &stderr)
+	if rc != 2 {
+		t.Fatalf("rc=%d want 2", rc)
+	}
+	if !strings.Contains(stderr.String(), "usage: bee preflight") {
+		t.Fatalf("stderr missing preflight usage:\n%s", stderr.String())
+	}
+}
+
+func TestRunSupportBundleRejectsExtraArgs(t *testing.T) {
+	t.Parallel()
+
+	var stdout, stderr bytes.Buffer
+	rc := run([]string{"support-bundle", "extra"}, &stdout, &stderr)
+	if rc != 2 {
+		t.Fatalf("rc=%d want 2", rc)
+	}
+	if !strings.Contains(stderr.String(), "usage: bee support-bundle") {
+		t.Fatalf("stderr missing support-bundle usage:\n%s", stderr.String())
+	}
+}
+
 func TestRunHelpForSubcommand(t *testing.T) {
 	t.Parallel()
 
@@ -138,7 +164,7 @@ func TestRunSATHelp(t *testing.T) {
 	if rc != 0 {
 		t.Fatalf("rc=%d want 0", rc)
 	}
-	if !strings.Contains(stdout.String(), "usage: bee sat nvidia|memory|storage") {
+	if !strings.Contains(stdout.String(), "usage: bee sat nvidia|memory|storage|cpu") {
 		t.Fatalf("stdout missing sat help:\n%s", stdout.String())
 	}
 }
@@ -151,8 +177,8 @@ func TestRunSATRejectsExtraArgs(t *testing.T) {
 	if rc != 2 {
 		t.Fatalf("rc=%d want 2", rc)
 	}
-	if !strings.Contains(stderr.String(), "usage: bee sat nvidia|memory|storage") {
-		t.Fatalf("stderr missing sat usage:\n%s", stderr.String())
+	if !strings.Contains(stderr.String(), "bee sat: unexpected arguments") {
+		t.Fatalf("stderr missing sat error:\n%s", stderr.String())
 	}
 }
 

audit/go.mod

@@ -1,12 +1,16 @@
 module bee/audit
 
-go 1.23
+go 1.24.0
+
+replace reanimator/chart => ../internal/chart
 
 require github.com/charmbracelet/bubbletea v1.3.4
+require github.com/charmbracelet/lipgloss v1.0.0
+require reanimator/chart v0.0.0
 
 require (
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
-	github.com/charmbracelet/lipgloss v1.0.0 // indirect
+	github.com/charmbracelet/lipgloss v1.0.0 // promoted to direct — used for TUI colors
 	github.com/charmbracelet/x/ansi v0.8.0 // indirect
 	github.com/charmbracelet/x/term v0.2.1 // indirect
 	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect

audit/internal/app/app.go

@@ -1,8 +1,10 @@
 package app
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
+	"log/slog"
 	"os"
 	"path/filepath"
 	"sort"
@@ -17,9 +19,17 @@ import (
 )
 
 var (
-	DefaultAuditJSONPath = "/var/log/bee-audit.json"
-	DefaultAuditLogPath  = "/var/log/bee-audit.log"
-	DefaultSATBaseDir    = "/var/log/bee-sat"
+	DefaultExportDir       = "/appdata/bee/export"
+	DefaultAuditJSONPath   = DefaultExportDir + "/bee-audit.json"
+	DefaultAuditLogPath    = DefaultExportDir + "/bee-audit.log"
+	DefaultWebLogPath      = DefaultExportDir + "/bee-web.log"
+	DefaultNetworkLogPath  = DefaultExportDir + "/bee-network.log"
+	DefaultNvidiaLogPath   = DefaultExportDir + "/bee-nvidia.log"
+	DefaultSSHLogPath      = DefaultExportDir + "/bee-sshsetup.log"
+	DefaultRuntimeJSONPath = DefaultExportDir + "/runtime-health.json"
+	DefaultRuntimeLogPath  = DefaultExportDir + "/runtime-health.log"
+	DefaultTechDumpDir     = DefaultExportDir + "/techdump"
+	DefaultSATBaseDir      = DefaultExportDir + "/bee-sat"
 )
 
 type App struct {
@@ -28,6 +38,7 @@ type App struct {
 	exports  exportManager
 	tools    toolManager
 	sat      satRunner
+	runtime  runtimeChecker
 }
 
 type ActionResult struct {
@@ -61,8 +72,19 @@ type toolManager interface {
 
 type satRunner interface {
 	RunNvidiaAcceptancePack(baseDir string) (string, error)
+	RunNvidiaAcceptancePackWithOptions(ctx context.Context, baseDir string, durationSec int, sizeMB int, gpuIndices []int) (string, error)
 	RunMemoryAcceptancePack(baseDir string) (string, error)
 	RunStorageAcceptancePack(baseDir string) (string, error)
+	RunCPUAcceptancePack(baseDir string, durationSec int) (string, error)
+	ListNvidiaGPUs() ([]platform.NvidiaGPU, error)
+	DetectGPUVendor() string
+	ListAMDGPUs() ([]platform.AMDGPUInfo, error)
+	RunAMDAcceptancePack(baseDir string) (string, error)
+}
+
+type runtimeChecker interface {
+	CollectRuntimeHealth(exportDir string) (schema.RuntimeHealth, error)
+	CaptureTechnicalDump(baseDir string) error
 }
 
 func New(platform *platform.System) *App {
@@ -72,11 +94,20 @@ func New(platform *platform.System) *App {
 		exports:  platform,
 		tools:    platform,
 		sat:      platform,
+		runtime:  platform,
 	}
 }
 
 func (a *App) RunAudit(runtimeMode runtimeenv.Mode, output string) (string, error) {
+	if runtimeMode == runtimeenv.ModeLiveCD {
+		if err := a.runtime.CaptureTechnicalDump(DefaultTechDumpDir); err != nil {
+			slog.Warn("capture technical dump", "err", err)
+		}
+	}
 	result := collector.Run(runtimeMode)
+	if health, err := ReadRuntimeHealth(DefaultRuntimeJSONPath); err == nil {
+		result.Runtime = &health
+	}
 	data, err := json.MarshalIndent(result, "", "  ")
 	if err != nil {
 		return "", err
@@ -88,6 +119,9 @@ func (a *App) RunAudit(runtimeMode runtimeenv.Mode, output string) (string, erro
 		return "stdout", err
 	case strings.HasPrefix(output, "file:"):
 		path := strings.TrimPrefix(output, "file:")
+		if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
+			return "", err
+		}
 		if err := os.WriteFile(path, append(data, '\n'), 0644); err != nil {
 			return "", err
 		}
@@ -97,6 +131,72 @@ func (a *App) RunAudit(runtimeMode runtimeenv.Mode, output string) (string, erro
 	}
 }
 
+func (a *App) RunRuntimePreflight(output string) (string, error) {
+	health, err := a.runtime.CollectRuntimeHealth(DefaultExportDir)
+	if err != nil {
+		return "", err
+	}
+	data, err := json.MarshalIndent(health, "", "  ")
+	if err != nil {
+		return "", err
+	}
+
+	switch {
+	case output == "stdout":
+		_, err := os.Stdout.Write(append(data, '\n'))
+		return "stdout", err
+	case strings.HasPrefix(output, "file:"):
+		path := strings.TrimPrefix(output, "file:")
+		if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
+			return "", err
+		}
+		if err := os.WriteFile(path, append(data, '\n'), 0644); err != nil {
+			return "", err
+		}
+		return path, nil
+	default:
+		return "", fmt.Errorf("unknown output destination %q — use stdout or file:<path>", output)
+	}
+}
+
+func (a *App) RunRuntimePreflightResult() (ActionResult, error) {
+	path, err := a.RunRuntimePreflight("file:" + DefaultRuntimeJSONPath)
+	body := "Runtime preflight completed."
+	if path != "" {
+		body = "Runtime health written to " + path
+	}
+	return ActionResult{Title: "Run self-check", Body: body}, err
+}
+
+func (a *App) RuntimeHealthResult() ActionResult {
+	health, err := ReadRuntimeHealth(DefaultRuntimeJSONPath)
+	if err != nil {
+		return ActionResult{Title: "Runtime issues", Body: "No runtime health found."}
+	}
+	driverLabel := "Driver ready"
+	accelLabel := "CUDA ready"
+	switch a.sat.DetectGPUVendor() {
+	case "amd":
+		driverLabel = "AMDGPU ready"
+		accelLabel = "ROCm SMI ready"
+	case "nvidia":
+		driverLabel = "NVIDIA ready"
+	}
+	var body strings.Builder
+	fmt.Fprintf(&body, "Status: %s\n", firstNonEmpty(health.Status, "UNKNOWN"))
+	fmt.Fprintf(&body, "Export dir: %s\n", firstNonEmpty(health.ExportDir, DefaultExportDir))
+	fmt.Fprintf(&body, "%s: %t\n", driverLabel, health.DriverReady)
+	fmt.Fprintf(&body, "%s: %t\n", accelLabel, health.CUDAReady)
+	fmt.Fprintf(&body, "Network: %s", firstNonEmpty(health.NetworkStatus, "UNKNOWN"))
+	if len(health.Issues) > 0 {
+		body.WriteString("\n\nIssues:\n")
+		for _, issue := range health.Issues {
+			fmt.Fprintf(&body, "- %s: %s\n", issue.Code, issue.Description)
+		}
+	}
+	return ActionResult{Title: "Runtime issues", Body: strings.TrimSpace(body.String())}
+}
+
 func (a *App) RunAuditNow(runtimeMode runtimeenv.Mode) (ActionResult, error) {
 	path, err := a.RunAudit(runtimeMode, "file:"+DefaultAuditJSONPath)
 	body := "Audit completed."
@@ -136,6 +236,24 @@ func (a *App) ExportLatestAuditResult(target platform.RemovableTarget) (ActionRe
 	return ActionResult{Title: "Export audit", Body: body}, err
 }
 
+func (a *App) ExportSupportBundle(target platform.RemovableTarget) (string, error) {
+	archive, err := BuildSupportBundle(DefaultExportDir)
+	if err != nil {
+		return "", err
+	}
+	defer os.Remove(archive)
+	return a.exports.ExportFileToTarget(archive, target)
+}
+
+func (a *App) ExportSupportBundleResult(target platform.RemovableTarget) (ActionResult, error) {
+	path, err := a.ExportSupportBundle(target)
+	body := "Support bundle exported. USB target unmounted and safe to remove."
+	if path != "" {
+		body = "Support bundle exported to " + path + ".\n\nUSB target unmounted and safe to remove."
+	}
+	return ActionResult{Title: "Export support bundle", Body: body}, err
+}
+
 func (a *App) ListInterfaces() ([]platform.InterfaceInfo, error) {
 	return a.network.ListInterfaces()
 }
@@ -278,11 +396,14 @@ func (a *App) AuditLogTailResult() ActionResult {
 }
 
 func (a *App) RunNvidiaAcceptancePack(baseDir string) (string, error) {
+	if strings.TrimSpace(baseDir) == "" {
+		baseDir = DefaultSATBaseDir
+	}
 	return a.sat.RunNvidiaAcceptancePack(baseDir)
 }
 
 func (a *App) RunNvidiaAcceptancePackResult(baseDir string) (ActionResult, error) {
-	path, err := a.sat.RunNvidiaAcceptancePack(baseDir)
+	path, err := a.RunNvidiaAcceptancePack(baseDir)
 	body := "Archive written."
 	if path != "" {
 		body = "Archive written to " + path
@@ -290,30 +411,97 @@ func (a *App) RunNvidiaAcceptancePackResult(baseDir string) (ActionResult, error
 	return ActionResult{Title: "NVIDIA SAT", Body: body}, err
 }
 
+func (a *App) ListNvidiaGPUs() ([]platform.NvidiaGPU, error) {
+	return a.sat.ListNvidiaGPUs()
+}
+
+func (a *App) RunNvidiaAcceptancePackWithOptions(ctx context.Context, baseDir string, durationSec int, sizeMB int, gpuIndices []int) (ActionResult, error) {
+	if strings.TrimSpace(baseDir) == "" {
+		baseDir = DefaultSATBaseDir
+	}
+	path, err := a.sat.RunNvidiaAcceptancePackWithOptions(ctx, baseDir, durationSec, sizeMB, gpuIndices)
+	body := "Archive written."
+	if path != "" {
+		body = "Archive written to " + path
+	}
+	// Include terminal chart if available (runDir = archive path without .tar.gz).
+	if path != "" {
+		termPath := filepath.Join(strings.TrimSuffix(path, ".tar.gz"), "gpu-metrics-term.txt")
+		if chart, readErr := os.ReadFile(termPath); readErr == nil && len(chart) > 0 {
+			body += "\n\n" + string(chart)
+		}
+	}
+	return ActionResult{Title: "NVIDIA SAT", Body: body}, err
+}
+
 func (a *App) RunMemoryAcceptancePack(baseDir string) (string, error) {
+	if strings.TrimSpace(baseDir) == "" {
+		baseDir = DefaultSATBaseDir
+	}
 	return a.sat.RunMemoryAcceptancePack(baseDir)
 }
 
 func (a *App) RunMemoryAcceptancePackResult(baseDir string) (ActionResult, error) {
-	path, err := a.sat.RunMemoryAcceptancePack(baseDir)
-	body := "Archive written."
-	if path != "" {
-		body = "Archive written to " + path
+	path, err := a.RunMemoryAcceptancePack(baseDir)
+	return ActionResult{Title: "Memory SAT", Body: satResultBody(path)}, err
+}
+
+func (a *App) RunCPUAcceptancePack(baseDir string, durationSec int) (string, error) {
+	if strings.TrimSpace(baseDir) == "" {
+		baseDir = DefaultSATBaseDir
 	}
-	return ActionResult{Title: "Memory SAT", Body: body}, err
+	return a.sat.RunCPUAcceptancePack(baseDir, durationSec)
+}
+
+func (a *App) RunCPUAcceptancePackResult(baseDir string, durationSec int) (ActionResult, error) {
+	path, err := a.RunCPUAcceptancePack(baseDir, durationSec)
+	return ActionResult{Title: "CPU SAT", Body: satResultBody(path)}, err
 }
 
 func (a *App) RunStorageAcceptancePack(baseDir string) (string, error) {
+	if strings.TrimSpace(baseDir) == "" {
+		baseDir = DefaultSATBaseDir
+	}
 	return a.sat.RunStorageAcceptancePack(baseDir)
 }
 
 func (a *App) RunStorageAcceptancePackResult(baseDir string) (ActionResult, error) {
-	path, err := a.sat.RunStorageAcceptancePack(baseDir)
-	body := "Archive written."
-	if path != "" {
-		body = "Archive written to " + path
+	path, err := a.RunStorageAcceptancePack(baseDir)
+	return ActionResult{Title: "Storage SAT", Body: satResultBody(path)}, err
+}
+
+func (a *App) DetectGPUVendor() string {
+	return a.sat.DetectGPUVendor()
+}
+
+func (a *App) ListAMDGPUs() ([]platform.AMDGPUInfo, error) {
+	return a.sat.ListAMDGPUs()
+}
+
+func (a *App) RunAMDAcceptancePack(baseDir string) (string, error) {
+	if strings.TrimSpace(baseDir) == "" {
+		baseDir = DefaultSATBaseDir
 	}
-	return ActionResult{Title: "Storage SAT", Body: body}, err
+	return a.sat.RunAMDAcceptancePack(baseDir)
+}
+
+func (a *App) RunAMDAcceptancePackResult(baseDir string) (ActionResult, error) {
+	path, err := a.RunAMDAcceptancePack(baseDir)
+	return ActionResult{Title: "AMD GPU SAT", Body: satResultBody(path)}, err
+}
+
+// satResultBody reads summary.txt from the SAT run directory (archive path without .tar.gz)
+// and returns a formatted human-readable result. Falls back to a plain message if unreadable.
+func satResultBody(archivePath string) string {
+	if archivePath == "" {
+		return "No output produced."
+	}
+	runDir := strings.TrimSuffix(archivePath, ".tar.gz")
+	raw, err := os.ReadFile(filepath.Join(runDir, "summary.txt"))
+	if err != nil {
+		return "Archive written to " + archivePath
+	}
+	return formatSATDetail(strings.TrimSpace(string(raw)))
 }
 
 func (a *App) HealthSummaryResult() ActionResult {
@@ -435,6 +623,18 @@ func bodyOr(body, fallback string) string {
 	return body
 }
 
+func ReadRuntimeHealth(path string) (schema.RuntimeHealth, error) {
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		return schema.RuntimeHealth{}, err
+	}
+	var health schema.RuntimeHealth
+	if err := json.Unmarshal(raw, &health); err != nil {
+		return schema.RuntimeHealth{}, err
+	}
+	return health, nil
+}
+
 func latestSATSummaries() []string {
 	patterns := []struct {
 		label  string
@@ -443,6 +643,7 @@ func latestSATSummaries() []string {
 		{label: "NVIDIA SAT", prefix: "gpu-nvidia-"},
 		{label: "Memory SAT", prefix: "memory-"},
 		{label: "Storage SAT", prefix: "storage-"},
+		{label: "CPU SAT", prefix: "cpu-"},
 	}
 	var out []string
 	for _, item := range patterns {
@@ -647,12 +848,17 @@ func isGPUDevice(dev schema.HardwarePCIeDevice) bool {
 	class := trimPtr(dev.DeviceClass)
 	model := strings.ToLower(trimPtr(dev.Model))
 	vendor := strings.ToLower(trimPtr(dev.Manufacturer))
+	// Exclude ASPEED (BMC VGA adapter, not a compute GPU)
+	if strings.Contains(vendor, "aspeed") || strings.Contains(model, "aspeed") {
+		return false
+	}
+	// AMD Instinct / Radeon compute GPUs have class ProcessingAccelerator or DisplayController.
+	// Do NOT match by AMD vendor alone — chipset/CPU PCIe devices share that vendor.
 	return class == "VideoController" ||
 		class == "DisplayController" ||
 		class == "ProcessingAccelerator" ||
 		strings.Contains(model, "nvidia") ||
-		strings.Contains(vendor, "nvidia") ||
-		strings.Contains(vendor, "amd")
+		strings.Contains(vendor, "nvidia")
 }
 
 func trimPtr(value *string) string {

audit/internal/app/app_test.go

@@ -1,8 +1,12 @@
 package app
 
 import (
+	"archive/tar"
+	"compress/gzip"
+	"context"
 	"encoding/json"
 	"errors"
+	"io"
 	"os"
 	"path/filepath"
 	"testing"
@@ -56,16 +60,41 @@ func (f fakeServices) ServiceDo(name string, action platform.ServiceAction) (str
 	return f.serviceDoFn(name, action)
 }
 
-type fakeExports struct{}
+type fakeExports struct {
+	listTargetsFn    func() ([]platform.RemovableTarget, error)
+	exportToTargetFn func(string, platform.RemovableTarget) (string, error)
+}
 
 func (f fakeExports) ListRemovableTargets() ([]platform.RemovableTarget, error) {
+	if f.listTargetsFn != nil {
+		return f.listTargetsFn()
+	}
 	return nil, nil
 }
 
 func (f fakeExports) ExportFileToTarget(src string, target platform.RemovableTarget) (string, error) {
+	if f.exportToTargetFn != nil {
+		return f.exportToTargetFn(src, target)
+	}
 	return "", nil
 }
 
+type fakeRuntime struct {
+	collectFn func(string) (schema.RuntimeHealth, error)
+	dumpFn    func(string) error
+}
+
+func (f fakeRuntime) CollectRuntimeHealth(exportDir string) (schema.RuntimeHealth, error) {
+	return f.collectFn(exportDir)
+}
+
+func (f fakeRuntime) CaptureTechnicalDump(baseDir string) error {
+	if f.dumpFn != nil {
+		return f.dumpFn(baseDir)
+	}
+	return nil
+}
+
 type fakeTools struct {
 	tailFileFn   func(string, int) string
 	checkToolsFn func([]string) []platform.ToolStatus
@@ -80,15 +109,31 @@ func (f fakeTools) CheckTools(names []string) []platform.ToolStatus {
 }
 
 type fakeSAT struct {
-	runNvidiaFn  func(string) (string, error)
-	runMemoryFn  func(string) (string, error)
-	runStorageFn func(string) (string, error)
+	runNvidiaFn      func(string) (string, error)
+	runMemoryFn      func(string) (string, error)
+	runStorageFn     func(string) (string, error)
+	runCPUFn         func(string, int) (string, error)
+	detectVendorFn   func() string
+	listAMDGPUsFn    func() ([]platform.AMDGPUInfo, error)
+	runAMDPackFn     func(string) (string, error)
+	listNvidiaGPUsFn func() ([]platform.NvidiaGPU, error)
 }
 
 func (f fakeSAT) RunNvidiaAcceptancePack(baseDir string) (string, error) {
 	return f.runNvidiaFn(baseDir)
 }
 
+func (f fakeSAT) RunNvidiaAcceptancePackWithOptions(_ context.Context, baseDir string, _ int, _ int, _ []int) (string, error) {
+	return f.runNvidiaFn(baseDir)
+}
+
+func (f fakeSAT) ListNvidiaGPUs() ([]platform.NvidiaGPU, error) {
+	if f.listNvidiaGPUsFn != nil {
+		return f.listNvidiaGPUsFn()
+	}
+	return nil, nil
+}
+
 func (f fakeSAT) RunMemoryAcceptancePack(baseDir string) (string, error) {
 	return f.runMemoryFn(baseDir)
 }
@@ -97,6 +142,34 @@ func (f fakeSAT) RunStorageAcceptancePack(baseDir string) (string, error) {
 	return f.runStorageFn(baseDir)
 }
 
+func (f fakeSAT) RunCPUAcceptancePack(baseDir string, durationSec int) (string, error) {
+	if f.runCPUFn != nil {
+		return f.runCPUFn(baseDir, durationSec)
+	}
+	return "", nil
+}
+
+func (f fakeSAT) DetectGPUVendor() string {
+	if f.detectVendorFn != nil {
+		return f.detectVendorFn()
+	}
+	return ""
+}
+
+func (f fakeSAT) ListAMDGPUs() ([]platform.AMDGPUInfo, error) {
+	if f.listAMDGPUsFn != nil {
+		return f.listAMDGPUsFn()
+	}
+	return nil, nil
+}
+
+func (f fakeSAT) RunAMDAcceptancePack(baseDir string) (string, error) {
+	if f.runAMDPackFn != nil {
+		return f.runAMDPackFn(baseDir)
+	}
+	return "", nil
+}
+
 func TestNetworkStatusFormatsInterfacesAndRoute(t *testing.T) {
 	t.Parallel()
 
@@ -110,6 +183,9 @@ func TestNetworkStatusFormatsInterfacesAndRoute(t *testing.T) {
 			},
 			defaultRouteFn: func() string { return "10.0.0.1" },
 		},
+		runtime: fakeRuntime{
+			collectFn: func(string) (schema.RuntimeHealth, error) { return schema.RuntimeHealth{}, nil },
+		},
 	}
 
 	result, err := a.NetworkStatus()
@@ -138,6 +214,9 @@ func TestNetworkStatusHandlesNoInterfaces(t *testing.T) {
 			listInterfacesFn: func() ([]platform.InterfaceInfo, error) { return nil, nil },
 			defaultRouteFn:   func() string { return "" },
 		},
+		runtime: fakeRuntime{
+			collectFn: func(string) (schema.RuntimeHealth, error) { return schema.RuntimeHealth{}, nil },
+		},
 	}
 
 	result, err := a.NetworkStatus()
@@ -159,6 +238,9 @@ func TestNetworkStatusPropagatesListError(t *testing.T) {
 			},
 			defaultRouteFn: func() string { return "" },
 		},
+		runtime: fakeRuntime{
+			collectFn: func(string) (schema.RuntimeHealth, error) { return schema.RuntimeHealth{}, nil },
+		},
 	}
 
 	result, err := a.NetworkStatus()
@@ -183,6 +265,9 @@ func TestParseStaticIPv4ConfigAndDefaults(t *testing.T) {
 			dhcpAllFn:       func() (string, error) { return "", nil },
 			setStaticIPv4Fn: func(platform.StaticIPv4Config) (string, error) { return "", nil },
 		},
+		runtime: fakeRuntime{
+			collectFn: func(string) (schema.RuntimeHealth, error) { return schema.RuntimeHealth{}, nil },
+		},
 	}
 
 	defaults := a.DefaultStaticIPv4FormFields("eth0")
@@ -219,6 +304,9 @@ func TestServiceActionResults(t *testing.T) {
 				return string(action) + " ok", nil
 			},
 		},
+		runtime: fakeRuntime{
+			collectFn: func(string) (schema.RuntimeHealth, error) { return schema.RuntimeHealth{}, nil },
+		},
 	}
 
 	statusResult, err := a.ServiceStatusResult("bee-audit")
@@ -301,6 +389,11 @@ func TestActionResultsUseFallbackBody(t *testing.T) {
 			runMemoryFn:  func(string) (string, error) { return "", nil },
 			runStorageFn: func(string) (string, error) { return "", nil },
 		},
+		runtime: fakeRuntime{
+			collectFn: func(string) (schema.RuntimeHealth, error) {
+				return schema.RuntimeHealth{Status: "PARTIAL", ExportDir: "/tmp/export"}, nil
+			},
+		},
 	}
 
 	if got, _ := a.DHCPOneResult("eth0"); got.Body != "DHCP completed." {
@@ -327,14 +420,52 @@ func TestActionResultsUseFallbackBody(t *testing.T) {
 	if got, _ := a.RunNvidiaAcceptancePackResult(""); got.Body != "Archive written." {
 		t.Fatalf("sat body=%q", got.Body)
 	}
-	if got, _ := a.RunMemoryAcceptancePackResult(""); got.Body != "Archive written." {
+	if got, _ := a.RunMemoryAcceptancePackResult(""); got.Body != "No output produced." {
 		t.Fatalf("memory sat body=%q", got.Body)
 	}
-	if got, _ := a.RunStorageAcceptancePackResult(""); got.Body != "Archive written." {
+	if got, _ := a.RunStorageAcceptancePackResult(""); got.Body != "No output produced." {
 		t.Fatalf("storage sat body=%q", got.Body)
 	}
 }
 
+func TestExportSupportBundleResultMentionsUnmountedUSB(t *testing.T) {
+	t.Parallel()
+
+	tmp := t.TempDir()
+	oldExportDir := DefaultExportDir
+	DefaultExportDir = tmp
+	t.Cleanup(func() { DefaultExportDir = oldExportDir })
+
+	if err := os.WriteFile(filepath.Join(tmp, "bee-audit.json"), []byte("{}\n"), 0644); err != nil {
+		t.Fatalf("write bee-audit.json: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(tmp, "bee-audit.log"), []byte("audit ok\n"), 0644); err != nil {
+		t.Fatalf("write bee-audit.log: %v", err)
+	}
+
+	a := &App{
+		exports: fakeExports{
+			exportToTargetFn: func(src string, target platform.RemovableTarget) (string, error) {
+				if filepath.Base(src) == "" {
+					t.Fatalf("expected non-empty source path")
+				}
+				return "/media/bee/" + filepath.Base(src), nil
+			},
+		},
+	}
+
+	result, err := a.ExportSupportBundleResult(platform.RemovableTarget{Device: "/dev/sdb1"})
+	if err != nil {
+		t.Fatalf("ExportSupportBundleResult error: %v", err)
+	}
+	if result.Title != "Export support bundle" {
+		t.Fatalf("title=%q want %q", result.Title, "Export support bundle")
+	}
+	if want := "USB target unmounted and safe to remove."; !contains(result.Body, want) {
+		t.Fatalf("body missing %q\nbody=%s", want, result.Body)
+	}
+}
+
 func TestRunNvidiaAcceptancePackResult(t *testing.T) {
 	t.Parallel()
 
@@ -349,6 +480,9 @@ func TestRunNvidiaAcceptancePackResult(t *testing.T) {
 			runMemoryFn:  func(string) (string, error) { return "", nil },
 			runStorageFn: func(string) (string, error) { return "", nil },
 		},
+		runtime: fakeRuntime{
+			collectFn: func(string) (schema.RuntimeHealth, error) { return schema.RuntimeHealth{}, nil },
+		},
 	}
 
 	result, err := a.RunNvidiaAcceptancePackResult("/tmp/sat")
@@ -360,6 +494,50 @@ func TestRunNvidiaAcceptancePackResult(t *testing.T) {
 	}
 }
 
+func TestRunSATDefaultsToExportDir(t *testing.T) {
+	t.Parallel()
+
+	oldSATBaseDir := DefaultSATBaseDir
+	DefaultSATBaseDir = "/tmp/export/bee-sat"
+	t.Cleanup(func() { DefaultSATBaseDir = oldSATBaseDir })
+
+	a := &App{
+		sat: fakeSAT{
+			runNvidiaFn: func(baseDir string) (string, error) {
+				if baseDir != "/tmp/export/bee-sat" {
+					t.Fatalf("nvidia baseDir=%q", baseDir)
+				}
+				return "", nil
+			},
+			runMemoryFn: func(baseDir string) (string, error) {
+				if baseDir != "/tmp/export/bee-sat" {
+					t.Fatalf("memory baseDir=%q", baseDir)
+				}
+				return "", nil
+			},
+			runStorageFn: func(baseDir string) (string, error) {
+				if baseDir != "/tmp/export/bee-sat" {
+					t.Fatalf("storage baseDir=%q", baseDir)
+				}
+				return "", nil
+			},
+		},
+		runtime: fakeRuntime{
+			collectFn: func(string) (schema.RuntimeHealth, error) { return schema.RuntimeHealth{}, nil },
+		},
+	}
+
+	if _, err := a.RunNvidiaAcceptancePack(""); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := a.RunMemoryAcceptancePack(""); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := a.RunStorageAcceptancePack(""); err != nil {
+		t.Fatal(err)
+	}
+}
+
 func TestFormatSATSummary(t *testing.T) {
 	t.Parallel()
 
@@ -398,6 +576,69 @@ func TestHealthSummaryResultIncludesCompactSATSummary(t *testing.T) {
 	}
 }
 
+func TestBuildSupportBundleIncludesExportDirContents(t *testing.T) {
+	tmp := t.TempDir()
+	exportDir := filepath.Join(tmp, "export")
+	if err := os.MkdirAll(filepath.Join(exportDir, "bee-sat", "memory-run"), 0755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(exportDir, "bee-audit.json"), []byte(`{"ok":true}`), 0644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(exportDir, "bee-sat", "memory-run", "verbose.log"), []byte("sat verbose"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(exportDir, "bee-sat", "memory-run.tar.gz"), []byte("nested sat archive"), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	archive, err := BuildSupportBundle(exportDir)
+	if err != nil {
+		t.Fatalf("BuildSupportBundle error: %v", err)
+	}
+	if _, err := os.Stat(archive); err != nil {
+		t.Fatalf("archive stat: %v", err)
+	}
+
+	file, err := os.Open(archive)
+	if err != nil {
+		t.Fatalf("open archive: %v", err)
+	}
+	defer file.Close()
+
+	gzr, err := gzip.NewReader(file)
+	if err != nil {
+		t.Fatalf("gzip reader: %v", err)
+	}
+	defer gzr.Close()
+
+	tr := tar.NewReader(gzr)
+	var names []string
+	for {
+		hdr, err := tr.Next()
+		if errors.Is(err, io.EOF) {
+			break
+		}
+		if err != nil {
+			t.Fatalf("read tar entry: %v", err)
+		}
+		names = append(names, hdr.Name)
+	}
+
+	var foundRaw bool
+	for _, name := range names {
+		if contains(name, "/export/bee-sat/memory-run/verbose.log") {
+			foundRaw = true
+		}
+		if contains(name, "/export/bee-sat/memory-run.tar.gz") {
+			t.Fatalf("support bundle should not contain nested SAT archive: %s", name)
+		}
+	}
+	if !foundRaw {
+		t.Fatalf("support bundle missing raw SAT log, names=%v", names)
+	}
+}
+
 func TestMainBanner(t *testing.T) {
 	tmp := t.TempDir()
 	oldAuditPath := DefaultAuditJSONPath
@@ -472,6 +713,44 @@ func TestMainBanner(t *testing.T) {
 	}
 }
 
+func TestRuntimeHealthResultUsesAMDLabels(t *testing.T) {
+	tmp := t.TempDir()
+	oldRuntimePath := DefaultRuntimeJSONPath
+	DefaultRuntimeJSONPath = filepath.Join(tmp, "runtime-health.json")
+	t.Cleanup(func() { DefaultRuntimeJSONPath = oldRuntimePath })
+
+	raw, err := json.Marshal(schema.RuntimeHealth{
+		Status:        "OK",
+		ExportDir:     "/appdata/bee/export",
+		DriverReady:   true,
+		CUDAReady:     true,
+		NetworkStatus: "OK",
+	})
+	if err != nil {
+		t.Fatalf("marshal runtime health: %v", err)
+	}
+	if err := os.WriteFile(DefaultRuntimeJSONPath, raw, 0644); err != nil {
+		t.Fatalf("write runtime health: %v", err)
+	}
+
+	a := &App{
+		sat: fakeSAT{
+			detectVendorFn: func() string { return "amd" },
+		},
+	}
+
+	result := a.RuntimeHealthResult()
+	if !contains(result.Body, "AMDGPU ready: true") {
+		t.Fatalf("body missing AMD driver label:\n%s", result.Body)
+	}
+	if !contains(result.Body, "ROCm SMI ready: true") {
+		t.Fatalf("body missing ROCm label:\n%s", result.Body)
+	}
+	if contains(result.Body, "CUDA ready") {
+		t.Fatalf("body should not mention CUDA on AMD:\n%s", result.Body)
+	}
+}
+
 func intPtr(v int) *int { return &v }
 
 func contains(haystack, needle string) bool {

audit/internal/app/panel.go

@@ -0,0 +1,387 @@
+package app
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+
+	"bee/audit/internal/schema"
+)
+
+// ComponentRow is one line in the hardware panel.
+type ComponentRow struct {
+	Key    string // "CPU", "MEM", "GPU", "DISK", "PSU"
+	Status string // "PASS", "FAIL", "CANCEL", "N/A"
+	Detail string // compact one-liner
+}
+
+// HardwarePanelData holds everything the TUI right panel needs.
+type HardwarePanelData struct {
+	Header []string
+	Rows   []ComponentRow
+}
+
+// LoadHardwarePanel reads the latest audit JSON and SAT summaries.
+// Returns empty panel if no audit data exists yet.
+func (a *App) LoadHardwarePanel() HardwarePanelData {
+	raw, err := os.ReadFile(DefaultAuditJSONPath)
+	if err != nil {
+		return HardwarePanelData{Header: []string{"No audit data — run audit first."}}
+	}
+	var snap schema.HardwareIngestRequest
+	if err := json.Unmarshal(raw, &snap); err != nil {
+		return HardwarePanelData{Header: []string{"Audit data unreadable."}}
+	}
+
+	statuses := satStatuses()
+
+	var header []string
+	if sys := formatSystemLine(snap.Hardware.Board); sys != "" {
+		header = append(header, sys)
+	}
+	for _, fw := range snap.Hardware.Firmware {
+		if fw.DeviceName == "BIOS" && fw.Version != "" {
+			header = append(header, "BIOS: "+fw.Version)
+		}
+		if fw.DeviceName == "BMC" && fw.Version != "" {
+			header = append(header, "BMC:  "+fw.Version)
+		}
+	}
+	if ip := formatIPLine(a.network.ListInterfaces); ip != "" {
+		header = append(header, ip)
+	}
+
+	var rows []ComponentRow
+
+	if cpu := formatCPULine(snap.Hardware.CPUs); cpu != "" {
+		rows = append(rows, ComponentRow{
+			Key:    "CPU",
+			Status: statuses["cpu"],
+			Detail: strings.TrimPrefix(cpu, "CPU: "),
+		})
+	}
+	if mem := formatMemoryLine(snap.Hardware.Memory); mem != "" {
+		rows = append(rows, ComponentRow{
+			Key:    "MEM",
+			Status: statuses["memory"],
+			Detail: strings.TrimPrefix(mem, "Memory: "),
+		})
+	}
+	if gpu := formatGPULine(snap.Hardware.PCIeDevices); gpu != "" {
+		rows = append(rows, ComponentRow{
+			Key:    "GPU",
+			Status: statuses["gpu"],
+			Detail: strings.TrimPrefix(gpu, "GPU: "),
+		})
+	}
+	if disk := formatStorageLine(snap.Hardware.Storage); disk != "" {
+		rows = append(rows, ComponentRow{
+			Key:    "DISK",
+			Status: statuses["storage"],
+			Detail: strings.TrimPrefix(disk, "Storage: "),
+		})
+	}
+	if psu := formatPSULine(snap.Hardware.PowerSupplies); psu != "" {
+		rows = append(rows, ComponentRow{
+			Key:    "PSU",
+			Status: "N/A",
+			Detail: psu,
+		})
+	}
+
+	return HardwarePanelData{Header: header, Rows: rows}
+}
+
+// ComponentDetailResult returns detail text for a component shown in the panel.
+func (a *App) ComponentDetailResult(key string) ActionResult {
+	switch key {
+	case "CPU":
+		return a.cpuDetailResult(false)
+	case "MEM":
+		return a.satDetailResult("memory", "memory-", "MEM detail")
+	case "GPU":
+		// Prefer whichever GPU SAT was run most recently.
+		nv, _ := filepath.Glob(filepath.Join(DefaultSATBaseDir, "gpu-nvidia-*/summary.txt"))
+		am, _ := filepath.Glob(filepath.Join(DefaultSATBaseDir, "gpu-amd-*/summary.txt"))
+		sort.Strings(nv)
+		sort.Strings(am)
+		latestNV := ""
+		if len(nv) > 0 {
+			latestNV = nv[len(nv)-1]
+		}
+		latestAM := ""
+		if len(am) > 0 {
+			latestAM = am[len(am)-1]
+		}
+		if latestAM > latestNV {
+			return a.satDetailResult("gpu", "gpu-amd-", "GPU detail")
+		}
+		return a.satDetailResult("gpu", "gpu-nvidia-", "GPU detail")
+	case "DISK":
+		return a.satDetailResult("storage", "storage-", "DISK detail")
+	case "PSU":
+		return a.psuDetailResult()
+	default:
+		return ActionResult{Title: key, Body: "No detail available."}
+	}
+}
+
+func (a *App) cpuDetailResult(satOnly bool) ActionResult {
+	var b strings.Builder
+
+	// Show latest SAT summary if available.
+	satResult := a.satDetailResult("cpu", "cpu-", "CPU SAT")
+	if satResult.Body != "No test results found. Run a test first." {
+		fmt.Fprintln(&b, "=== Last SAT ===")
+		fmt.Fprintln(&b, satResult.Body)
+		fmt.Fprintln(&b)
+	}
+
+	if satOnly {
+		body := strings.TrimSpace(b.String())
+		if body == "" {
+			body = "No CPU SAT results found. Run a test first."
+		}
+		return ActionResult{Title: "CPU SAT", Body: body}
+	}
+
+	raw, err := os.ReadFile(DefaultAuditJSONPath)
+	if err != nil {
+		return ActionResult{Title: "CPU", Body: strings.TrimSpace(b.String())}
+	}
+	var snap schema.HardwareIngestRequest
+	if err := json.Unmarshal(raw, &snap); err != nil {
+		return ActionResult{Title: "CPU", Body: strings.TrimSpace(b.String())}
+	}
+	if len(snap.Hardware.CPUs) == 0 {
+		return ActionResult{Title: "CPU", Body: strings.TrimSpace(b.String())}
+	}
+	fmt.Fprintln(&b, "=== Audit ===")
+	for i, cpu := range snap.Hardware.CPUs {
+		fmt.Fprintf(&b, "CPU %d\n", i)
+		if cpu.Model != nil {
+			fmt.Fprintf(&b, "  Model:    %s\n", *cpu.Model)
+		}
+		if cpu.Manufacturer != nil {
+			fmt.Fprintf(&b, "  Vendor:   %s\n", *cpu.Manufacturer)
+		}
+		if cpu.Cores != nil {
+			fmt.Fprintf(&b, "  Cores:    %d\n", *cpu.Cores)
+		}
+		if cpu.Threads != nil {
+			fmt.Fprintf(&b, "  Threads:  %d\n", *cpu.Threads)
+		}
+		if cpu.MaxFrequencyMHz != nil {
+			fmt.Fprintf(&b, "  Max freq: %d MHz\n", *cpu.MaxFrequencyMHz)
+		}
+		if cpu.TemperatureC != nil {
+			fmt.Fprintf(&b, "  Temp:     %.1f°C\n", *cpu.TemperatureC)
+		}
+		if cpu.Throttled != nil {
+			fmt.Fprintf(&b, "  Throttled: %v\n", *cpu.Throttled)
+		}
+		if cpu.CorrectableErrorCount != nil && *cpu.CorrectableErrorCount > 0 {
+			fmt.Fprintf(&b, "  ECC correctable:   %d\n", *cpu.CorrectableErrorCount)
+		}
+		if cpu.UncorrectableErrorCount != nil && *cpu.UncorrectableErrorCount > 0 {
+			fmt.Fprintf(&b, "  ECC uncorrectable: %d\n", *cpu.UncorrectableErrorCount)
+		}
+		if i < len(snap.Hardware.CPUs)-1 {
+			fmt.Fprintln(&b)
+		}
+	}
+	return ActionResult{Title: "CPU", Body: strings.TrimSpace(b.String())}
+}
+
+func (a *App) satDetailResult(statusKey, prefix, title string) ActionResult {
+	matches, err := filepath.Glob(filepath.Join(DefaultSATBaseDir, prefix+"*/summary.txt"))
+	if err != nil || len(matches) == 0 {
+		return ActionResult{Title: title, Body: "No test results found. Run a test first."}
+	}
+	sort.Strings(matches)
+	raw, err := os.ReadFile(matches[len(matches)-1])
+	if err != nil {
+		return ActionResult{Title: title, Body: "Could not read test results."}
+	}
+	return ActionResult{Title: title, Body: formatSATDetail(strings.TrimSpace(string(raw)))}
+}
+
+// formatSATDetail converts raw summary.txt key=value content to a human-readable per-step display.
+func formatSATDetail(raw string) string {
+	var b strings.Builder
+	kv := parseKeyValueSummary(raw)
+
+	if t, ok := kv["run_at_utc"]; ok {
+		fmt.Fprintf(&b, "Run: %s\n\n", t)
+	}
+
+	// Collect step names in order they appear in the file
+	lines := strings.Split(raw, "\n")
+	var stepKeys []string
+	seenStep := map[string]bool{}
+	for _, line := range lines {
+		if idx := strings.Index(line, "_status="); idx >= 0 {
+			key := line[:idx]
+			if !seenStep[key] && key != "overall" {
+				seenStep[key] = true
+				stepKeys = append(stepKeys, key)
+			}
+		}
+	}
+
+	for _, key := range stepKeys {
+		status := kv[key+"_status"]
+		display := cleanSummaryKey(key)
+		switch status {
+		case "OK":
+			fmt.Fprintf(&b, "PASS  %s\n", display)
+		case "FAILED":
+			fmt.Fprintf(&b, "FAIL  %s\n", display)
+		case "UNSUPPORTED":
+			fmt.Fprintf(&b, "SKIP  %s\n", display)
+		default:
+			fmt.Fprintf(&b, "?     %s\n", display)
+		}
+	}
+
+	if overall, ok := kv["overall_status"]; ok {
+		ok2 := kv["job_ok"]
+		failed := kv["job_failed"]
+		fmt.Fprintf(&b, "\nOverall: %s  (ok=%s  failed=%s)", overall, ok2, failed)
+	}
+
+	return strings.TrimSpace(b.String())
+}
+
+// cleanSummaryKey strips the leading numeric prefix from a SAT step key.
+// "1-lscpu" → "lscpu", "3-stress-ng" → "stress-ng"
+func cleanSummaryKey(key string) string {
+	idx := strings.Index(key, "-")
+	if idx <= 0 {
+		return key
+	}
+	prefix := key[:idx]
+	for _, c := range prefix {
+		if c < '0' || c > '9' {
+			return key
+		}
+	}
+	return key[idx+1:]
+}
+
+func (a *App) psuDetailResult() ActionResult {
+	raw, err := os.ReadFile(DefaultAuditJSONPath)
+	if err != nil {
+		return ActionResult{Title: "PSU", Body: "No audit data."}
+	}
+	var snap schema.HardwareIngestRequest
+	if err := json.Unmarshal(raw, &snap); err != nil {
+		return ActionResult{Title: "PSU", Body: "Audit data unreadable."}
+	}
+	if len(snap.Hardware.PowerSupplies) == 0 {
+		return ActionResult{Title: "PSU", Body: "No PSU data in last audit."}
+	}
+	var b strings.Builder
+	for i, psu := range snap.Hardware.PowerSupplies {
+		fmt.Fprintf(&b, "PSU %d\n", i)
+		if psu.Model != nil {
+			fmt.Fprintf(&b, "  Model:   %s\n", *psu.Model)
+		}
+		if psu.Vendor != nil {
+			fmt.Fprintf(&b, "  Vendor:  %s\n", *psu.Vendor)
+		}
+		if psu.WattageW != nil {
+			fmt.Fprintf(&b, "  Rated:   %d W\n", *psu.WattageW)
+		}
+		if psu.InputPowerW != nil {
+			fmt.Fprintf(&b, "  Input:   %.1f W\n", *psu.InputPowerW)
+		}
+		if psu.OutputPowerW != nil {
+			fmt.Fprintf(&b, "  Output:  %.1f W\n", *psu.OutputPowerW)
+		}
+		if psu.TemperatureC != nil {
+			fmt.Fprintf(&b, "  Temp:    %.1f°C\n", *psu.TemperatureC)
+		}
+		if i < len(snap.Hardware.PowerSupplies)-1 {
+			fmt.Fprintln(&b)
+		}
+	}
+	return ActionResult{Title: "PSU", Body: strings.TrimSpace(b.String())}
+}
+
+// satStatuses reads the latest summary.txt for each SAT type and returns
+// a map of component key ("gpu","memory","storage") → status ("PASS","FAIL","CANCEL","N/A").
+func satStatuses() map[string]string {
+	result := map[string]string{
+		"gpu":     "N/A",
+		"memory":  "N/A",
+		"storage": "N/A",
+		"cpu":     "N/A",
+	}
+	patterns := []struct {
+		key    string
+		prefix string
+	}{
+		{"gpu", "gpu-nvidia-"},
+		{"gpu", "gpu-amd-"},
+		{"memory", "memory-"},
+		{"storage", "storage-"},
+		{"cpu", "cpu-"},
+	}
+	for _, item := range patterns {
+		matches, err := filepath.Glob(filepath.Join(DefaultSATBaseDir, item.prefix+"*/summary.txt"))
+		if err != nil || len(matches) == 0 {
+			continue
+		}
+		sort.Strings(matches)
+		raw, err := os.ReadFile(matches[len(matches)-1])
+		if err != nil {
+			continue
+		}
+		values := parseKeyValueSummary(string(raw))
+		switch strings.ToUpper(strings.TrimSpace(values["overall_status"])) {
+		case "OK":
+			result[item.key] = "PASS"
+		case "FAILED":
+			result[item.key] = "FAIL"
+		case "CANCELED", "CANCELLED":
+			result[item.key] = "CANCEL"
+		}
+	}
+	return result
+}
+
+func formatPSULine(psus []schema.HardwarePowerSupply) string {
+	var present []schema.HardwarePowerSupply
+	for _, psu := range psus {
+		if psu.Present != nil && !*psu.Present {
+			continue
+		}
+		present = append(present, psu)
+	}
+	if len(present) == 0 {
+		return ""
+	}
+	firstW := 0
+	if present[0].WattageW != nil {
+		firstW = *present[0].WattageW
+	}
+	allSame := firstW > 0
+	for _, p := range present[1:] {
+		w := 0
+		if p.WattageW != nil {
+			w = *p.WattageW
+		}
+		if w != firstW {
+			allSame = false
+			break
+		}
+	}
+	if allSame && firstW > 0 {
+		return fmt.Sprintf("%dx %dW", len(present), firstW)
+	}
+	return fmt.Sprintf("%d PSU", len(present))
+}

audit/internal/app/support_bundle.go

@@ -0,0 +1,364 @@
+package app
+
+import (
+	"archive/tar"
+	"compress/gzip"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"sort"
+	"strings"
+	"time"
+)
+
+var supportBundleServices = []string{
+	"bee-audit.service",
+	"bee-web.service",
+	"bee-network.service",
+	"bee-nvidia.service",
+	"bee-preflight.service",
+	"bee-sshsetup.service",
+}
+
+var supportBundleCommands = []struct {
+	name string
+	cmd  []string
+}{
+	{name: "system/uname.txt", cmd: []string{"uname", "-a"}},
+	{name: "system/lsmod.txt", cmd: []string{"lsmod"}},
+	{name: "system/lspci-nn.txt", cmd: []string{"lspci", "-nn"}},
+	{name: "system/ip-addr.txt", cmd: []string{"ip", "addr"}},
+	{name: "system/ip-route.txt", cmd: []string{"ip", "route"}},
+	{name: "system/mount.txt", cmd: []string{"mount"}},
+	{name: "system/df-h.txt", cmd: []string{"df", "-h"}},
+	{name: "system/dmesg-tail.txt", cmd: []string{"sh", "-c", "dmesg | tail -n 200"}},
+}
+
+func BuildSupportBundle(exportDir string) (string, error) {
+	exportDir = strings.TrimSpace(exportDir)
+	if exportDir == "" {
+		exportDir = DefaultExportDir
+	}
+	if err := os.MkdirAll(exportDir, 0755); err != nil {
+		return "", err
+	}
+	if err := cleanupOldSupportBundles(os.TempDir()); err != nil {
+		return "", err
+	}
+
+	host := sanitizeFilename(hostnameOr("unknown"))
+	ts := time.Now().UTC().Format("20060102-150405")
+	stageRoot := filepath.Join(os.TempDir(), fmt.Sprintf("bee-support-%s-%s", host, ts))
+	if err := os.MkdirAll(stageRoot, 0755); err != nil {
+		return "", err
+	}
+	defer os.RemoveAll(stageRoot)
+
+	if err := copyExportDirForSupportBundle(exportDir, filepath.Join(stageRoot, "export")); err != nil {
+		return "", err
+	}
+	if err := writeJournalDump(filepath.Join(stageRoot, "systemd", "combined.journal.log")); err != nil {
+		return "", err
+	}
+	for _, svc := range supportBundleServices {
+		if err := writeCommandOutput(filepath.Join(stageRoot, "systemd", svc+".status.txt"), []string{"systemctl", "status", svc, "--no-pager"}); err != nil {
+			return "", err
+		}
+		if err := writeCommandOutput(filepath.Join(stageRoot, "systemd", svc+".journal.log"), []string{"journalctl", "--no-pager", "-u", svc}); err != nil {
+			return "", err
+		}
+	}
+	for _, item := range supportBundleCommands {
+		if err := writeCommandOutput(filepath.Join(stageRoot, item.name), item.cmd); err != nil {
+			return "", err
+		}
+	}
+	if err := writeManifest(filepath.Join(stageRoot, "manifest.txt"), exportDir, stageRoot); err != nil {
+		return "", err
+	}
+
+	archivePath := filepath.Join(os.TempDir(), fmt.Sprintf("bee-support-%s-%s.tar.gz", host, ts))
+	if err := createSupportTarGz(archivePath, stageRoot); err != nil {
+		return "", err
+	}
+	return archivePath, nil
+}
+
+func cleanupOldSupportBundles(dir string) error {
+	matches, err := filepath.Glob(filepath.Join(dir, "bee-support-*.tar.gz"))
+	if err != nil {
+		return err
+	}
+	type entry struct {
+		path string
+		mod  time.Time
+	}
+	list := make([]entry, 0, len(matches))
+	for _, match := range matches {
+		info, err := os.Stat(match)
+		if err != nil {
+			continue
+		}
+		if time.Since(info.ModTime()) > 24*time.Hour {
+			_ = os.Remove(match)
+			continue
+		}
+		list = append(list, entry{path: match, mod: info.ModTime()})
+	}
+	sort.Slice(list, func(i, j int) bool { return list[i].mod.After(list[j].mod) })
+	if len(list) > 3 {
+		for _, old := range list[3:] {
+			_ = os.Remove(old.path)
+		}
+	}
+	return nil
+}
+
+func writeJournalDump(dst string) error {
+	args := []string{"--no-pager"}
+	for _, svc := range supportBundleServices {
+		args = append(args, "-u", svc)
+	}
+	raw, err := exec.Command("journalctl", args...).CombinedOutput()
+	if len(raw) == 0 && err != nil {
+		raw = []byte(err.Error() + "\n")
+	}
+	if len(raw) == 0 {
+		raw = []byte("no journal output\n")
+	}
+	if err := os.MkdirAll(filepath.Dir(dst), 0755); err != nil {
+		return err
+	}
+	return os.WriteFile(dst, raw, 0644)
+}
+
+func writeCommandOutput(dst string, cmd []string) error {
+	if len(cmd) == 0 {
+		return nil
+	}
+	raw, err := exec.Command(cmd[0], cmd[1:]...).CombinedOutput()
+	if len(raw) == 0 {
+		if err != nil {
+			raw = []byte(err.Error() + "\n")
+		} else {
+			raw = []byte("no output\n")
+		}
+	}
+	if err := os.MkdirAll(filepath.Dir(dst), 0755); err != nil {
+		return err
+	}
+	return os.WriteFile(dst, raw, 0644)
+}
+
+func writeManifest(dst, exportDir, stageRoot string) error {
+	if err := os.MkdirAll(filepath.Dir(dst), 0755); err != nil {
+		return err
+	}
+	var body strings.Builder
+	fmt.Fprintf(&body, "bee_version=%s\n", buildVersion())
+	fmt.Fprintf(&body, "host=%s\n", hostnameOr("unknown"))
+	fmt.Fprintf(&body, "generated_at_utc=%s\n", time.Now().UTC().Format(time.RFC3339))
+	fmt.Fprintf(&body, "export_dir=%s\n", exportDir)
+	fmt.Fprintf(&body, "\nfiles:\n")
+
+	var files []string
+	if err := filepath.Walk(stageRoot, func(path string, info os.FileInfo, err error) error {
+		if err != nil || info.IsDir() {
+			return err
+		}
+		if filepath.Clean(path) == filepath.Clean(dst) {
+			return nil
+		}
+		rel, err := filepath.Rel(stageRoot, path)
+		if err != nil {
+			return err
+		}
+		files = append(files, fmt.Sprintf("%s\t%d", rel, info.Size()))
+		return nil
+	}); err != nil {
+		return err
+	}
+	sort.Strings(files)
+	for _, line := range files {
+		body.WriteString(line)
+		body.WriteByte('\n')
+	}
+	return os.WriteFile(dst, []byte(body.String()), 0644)
+}
+
+func buildVersion() string {
+	raw, err := exec.Command("bee", "version").CombinedOutput()
+	if err != nil {
+		return "unknown"
+	}
+	return strings.TrimSpace(string(raw))
+}
+
+func copyDirContents(srcDir, dstDir string) error {
+	entries, err := os.ReadDir(srcDir)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil
+		}
+		return err
+	}
+	for _, entry := range entries {
+		src := filepath.Join(srcDir, entry.Name())
+		dst := filepath.Join(dstDir, entry.Name())
+		if err := copyPath(src, dst); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func copyExportDirForSupportBundle(srcDir, dstDir string) error {
+	return copyDirContentsFiltered(srcDir, dstDir, func(rel string, info os.FileInfo) bool {
+		cleanRel := filepath.ToSlash(strings.TrimPrefix(filepath.Clean(rel), "./"))
+		if cleanRel == "" {
+			return true
+		}
+		if strings.HasPrefix(cleanRel, "bee-sat/") && strings.HasSuffix(cleanRel, ".tar.gz") {
+			return false
+		}
+		if strings.HasPrefix(filepath.Base(cleanRel), "bee-support-") && strings.HasSuffix(cleanRel, ".tar.gz") {
+			return false
+		}
+		return true
+	})
+}
+
+func copyDirContentsFiltered(srcDir, dstDir string, keep func(rel string, info os.FileInfo) bool) error {
+	entries, err := os.ReadDir(srcDir)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil
+		}
+		return err
+	}
+	for _, entry := range entries {
+		src := filepath.Join(srcDir, entry.Name())
+		dst := filepath.Join(dstDir, entry.Name())
+		if err := copyPathFiltered(srcDir, src, dst, keep); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func copyPath(src, dst string) error {
+	info, err := os.Stat(src)
+	if err != nil {
+		return err
+	}
+	if info.IsDir() {
+		if err := os.MkdirAll(dst, info.Mode().Perm()); err != nil {
+			return err
+		}
+		entries, err := os.ReadDir(src)
+		if err != nil {
+			return err
+		}
+		for _, entry := range entries {
+			if err := copyPath(filepath.Join(src, entry.Name()), filepath.Join(dst, entry.Name())); err != nil {
+				return err
+			}
+		}
+		return nil
+	}
+
+	if err := os.MkdirAll(filepath.Dir(dst), 0755); err != nil {
+		return err
+	}
+	in, err := os.Open(src)
+	if err != nil {
+		return err
+	}
+	defer in.Close()
+
+	out, err := os.OpenFile(dst, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, info.Mode().Perm())
+	if err != nil {
+		return err
+	}
+	defer out.Close()
+
+	_, err = io.Copy(out, in)
+	return err
+}
+
+func copyPathFiltered(rootSrc, src, dst string, keep func(rel string, info os.FileInfo) bool) error {
+	info, err := os.Stat(src)
+	if err != nil {
+		return err
+	}
+	rel, err := filepath.Rel(rootSrc, src)
+	if err != nil {
+		return err
+	}
+	if keep != nil && !keep(rel, info) {
+		return nil
+	}
+	if info.IsDir() {
+		if err := os.MkdirAll(dst, info.Mode().Perm()); err != nil {
+			return err
+		}
+		entries, err := os.ReadDir(src)
+		if err != nil {
+			return err
+		}
+		for _, entry := range entries {
+			if err := copyPathFiltered(rootSrc, filepath.Join(src, entry.Name()), filepath.Join(dst, entry.Name()), keep); err != nil {
+				return err
+			}
+		}
+		return nil
+	}
+	return copyPath(src, dst)
+}
+
+func createSupportTarGz(dst, srcDir string) error {
+	file, err := os.Create(dst)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+
+	gz := gzip.NewWriter(file)
+	defer gz.Close()
+
+	tw := tar.NewWriter(gz)
+	defer tw.Close()
+
+	base := filepath.Dir(srcDir)
+	return filepath.Walk(srcDir, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+		if info.IsDir() {
+			return nil
+		}
+
+		header, err := tar.FileInfoHeader(info, "")
+		if err != nil {
+			return err
+		}
+		header.Name, err = filepath.Rel(base, path)
+		if err != nil {
+			return err
+		}
+		if err := tw.WriteHeader(header); err != nil {
+			return err
+		}
+
+		f, err := os.Open(path)
+		if err != nil {
+			return err
+		}
+		defer f.Close()
+
+		_, err = io.Copy(tw, f)
+		return err
+	})
+}

audit/internal/collector/board.go

@@ -4,10 +4,27 @@ import (
 	"bee/audit/internal/schema"
 	"bufio"
 	"log/slog"
+	"os"
 	"os/exec"
 	"strings"
 )
 
+var execDmidecode = func(typeNum string) (string, error) {
+	out, err := exec.Command("dmidecode", "-t", typeNum).Output()
+	if err != nil {
+		return "", err
+	}
+	return string(out), nil
+}
+
+var execIpmitool = func(args ...string) (string, error) {
+	out, err := exec.Command("ipmitool", args...).Output()
+	if err != nil {
+		return "", err
+	}
+	return string(out), nil
+}
+
 // collectBoard runs dmidecode for types 0, 1, 2 and returns the board record
 // plus the BIOS firmware entry. Any failure is logged and returns zero values.
 func collectBoard() (schema.HardwareBoard, []schema.HardwareFirmwareRecord) {
@@ -61,6 +78,45 @@ func parseBoard(type1, type2 string) schema.HardwareBoard {
 	return board
 }
 
+// collectBMCFirmware collects BMC firmware version via ipmitool mc info.
+// Returns nil if ipmitool is missing, /dev/ipmi0 is absent, or any error occurs.
+func collectBMCFirmware() []schema.HardwareFirmwareRecord {
+	if _, err := exec.LookPath("ipmitool"); err != nil {
+		return nil
+	}
+	if _, err := os.Stat("/dev/ipmi0"); err != nil {
+		return nil
+	}
+	out, err := execIpmitool("mc", "info")
+	if err != nil {
+		slog.Info("bmc: ipmitool mc info unavailable", "err", err)
+		return nil
+	}
+	version := parseBMCFirmwareRevision(out)
+	if version == "" {
+		return nil
+	}
+	slog.Info("bmc: collected", "version", version)
+	return []schema.HardwareFirmwareRecord{
+		{DeviceName: "BMC", Version: version},
+	}
+}
+
+// parseBMCFirmwareRevision extracts the "Firmware Revision" field from ipmitool mc info output.
+func parseBMCFirmwareRevision(out string) string {
+	for _, line := range strings.Split(out, "\n") {
+		line = strings.TrimSpace(line)
+		key, val, ok := strings.Cut(line, ":")
+		if !ok {
+			continue
+		}
+		if strings.TrimSpace(key) == "Firmware Revision" {
+			return strings.TrimSpace(val)
+		}
+	}
+	return ""
+}
+
 // parseBIOSFirmware extracts BIOS version from dmidecode type 0 output.
 func parseBIOSFirmware(type0 string) []schema.HardwareFirmwareRecord {
 	fields := parseDMIFields(type0, "BIOS Information")
@@ -141,9 +197,5 @@ func cleanDMIValue(v string) string {
 
 // runDmidecode executes dmidecode -t <typeNum> and returns its stdout.
 func runDmidecode(typeNum string) (string, error) {
-	out, err := exec.Command("dmidecode", "-t", typeNum).Output()
-	if err != nil {
-		return "", err
-	}
-	return string(out), nil
+	return execDmidecode(typeNum)
 }

audit/internal/collector/collector.go

@@ -23,10 +23,9 @@ func Run(_ runtimeenv.Mode) schema.HardwareIngestRequest {
 	board, biosFW := collectBoard()
 	snap.Board = board
 	snap.Firmware = append(snap.Firmware, biosFW...)
+	snap.Firmware = append(snap.Firmware, collectBMCFirmware()...)
 
-	cpus, cpuFW := collectCPUs(snap.Board.SerialNumber)
-	snap.CPUs = cpus
-	snap.Firmware = append(snap.Firmware, cpuFW...)
+	snap.CPUs = collectCPUs()
 
 	snap.Memory = collectMemory()
 	sensorDoc, err := readSensorsJSONDoc()
@@ -37,7 +36,8 @@ func Run(_ runtimeenv.Mode) schema.HardwareIngestRequest {
 	snap.Memory = enrichMemoryWithTelemetry(snap.Memory, sensorDoc)
 	snap.Storage = collectStorage()
 	snap.PCIeDevices = collectPCIe()
-	snap.PCIeDevices = enrichPCIeWithNVIDIA(snap.PCIeDevices, snap.Board.SerialNumber)
+	snap.PCIeDevices = enrichPCIeWithPCISerials(snap.PCIeDevices)
+	snap.PCIeDevices = enrichPCIeWithNVIDIA(snap.PCIeDevices)
 	snap.PCIeDevices = enrichPCIeWithMellanox(snap.PCIeDevices)
 	snap.PCIeDevices = enrichPCIeWithNICTelemetry(snap.PCIeDevices)
 	snap.PCIeDevices = enrichPCIeWithRAIDTelemetry(snap.PCIeDevices)

audit/internal/collector/cpu.go

@@ -3,42 +3,39 @@ package collector
 import (
 	"bee/audit/internal/schema"
 	"bufio"
-	"fmt"
 	"log/slog"
 	"os"
+	"path/filepath"
 	"strconv"
 	"strings"
 )
 
-// collectCPUs runs dmidecode -t 4 and reads microcode version from sysfs.
-func collectCPUs(boardSerial string) ([]schema.HardwareCPU, []schema.HardwareFirmwareRecord) {
+// collectCPUs runs dmidecode -t 4 and enriches CPUs with microcode from sysfs.
+func collectCPUs() []schema.HardwareCPU {
 	out, err := runDmidecode("4")
 	if err != nil {
 		slog.Warn("cpu: dmidecode type 4 failed", "err", err)
-		return nil, nil
+		return nil
 	}
 
-	cpus := parseCPUs(out, boardSerial)
-
-	var firmware []schema.HardwareFirmwareRecord
+	cpus := parseCPUs(out)
 	if mc := readMicrocode(); mc != "" {
-		firmware = append(firmware, schema.HardwareFirmwareRecord{
-			DeviceName: "CPU Microcode",
-			Version:    mc,
-		})
+		for i := range cpus {
+			cpus[i].Firmware = &mc
+		}
 	}
 
 	slog.Info("cpu: collected", "count", len(cpus))
-	return cpus, firmware
+	return cpus
 }
 
 // parseCPUs splits dmidecode output into per-processor sections and parses each.
-func parseCPUs(output, boardSerial string) []schema.HardwareCPU {
+func parseCPUs(output string) []schema.HardwareCPU {
 	sections := splitDMISections(output, "Processor Information")
 	cpus := make([]schema.HardwareCPU, 0, len(sections))
 
 	for _, section := range sections {
-		cpu, ok := parseCPUSection(section, boardSerial)
+		cpu, ok := parseCPUSection(section)
 		if !ok {
 			continue
 		}
@@ -49,7 +46,7 @@ func parseCPUs(output, boardSerial string) []schema.HardwareCPU {
 
 // parseCPUSection parses one "Processor Information" block into a HardwareCPU.
 // Returns false if the socket is unpopulated.
-func parseCPUSection(fields map[string]string, boardSerial string) (schema.HardwareCPU, bool) {
+func parseCPUSection(fields map[string]string) (schema.HardwareCPU, bool) {
 	status := parseCPUStatus(fields["Status"])
 	if status == statusEmpty {
 		return schema.HardwareCPU{}, false
@@ -72,11 +69,6 @@ func parseCPUSection(fields map[string]string, boardSerial string) (schema.Hardw
 	}
 	if v := cleanDMIValue(fields["Serial Number"]); v != "" {
 		cpu.SerialNumber = &v
-	} else if boardSerial != "" && cpu.Socket != nil {
-		// Intel Xeon never exposes serial via DMI — generate stable fallback
-		// matching core's generateCPUVendorSerial() logic
-		fb := fmt.Sprintf("%s-CPU-%d", boardSerial, *cpu.Socket)
-		cpu.SerialNumber = &fb
 	}
 
 	if v := parseMHz(fields["Max Speed"]); v > 0 {
@@ -180,7 +172,7 @@ func parseInt(v string) int {
 // readMicrocode reads the CPU microcode revision from sysfs.
 // Returns empty string if unavailable.
 func readMicrocode() string {
-	data, err := os.ReadFile("/sys/devices/system/cpu/cpu0/microcode/version")
+	data, err := os.ReadFile(filepath.Join(cpuSysBaseDir, "cpu0", "microcode", "version"))
 	if err != nil {
 		return ""
 	}

audit/internal/collector/cpu_test.go

@@ -1,12 +1,14 @@
 package collector
 
 import (
+	"os"
+	"path/filepath"
 	"testing"
 )
 
 func TestParseCPUs_dual_socket(t *testing.T) {
 	out := mustReadFile(t, "testdata/dmidecode_type4.txt")
-	cpus := parseCPUs(out, "CAR315KA0803B90")
+	cpus := parseCPUs(out)
 
 	if len(cpus) != 2 {
 		t.Fatalf("expected 2 CPUs, got %d", len(cpus))
@@ -37,23 +39,22 @@ func TestParseCPUs_dual_socket(t *testing.T) {
 	if cpu0.Status == nil || *cpu0.Status != "OK" {
 		t.Errorf("cpu0 status: got %v, want OK", cpu0.Status)
 	}
-	// Intel Xeon serial not available → fallback
-	if cpu0.SerialNumber == nil || *cpu0.SerialNumber != "CAR315KA0803B90-CPU-0" {
-		t.Errorf("cpu0 serial fallback: got %v, want CAR315KA0803B90-CPU-0", cpu0.SerialNumber)
+	if cpu0.SerialNumber != nil {
+		t.Errorf("cpu0 serial should stay nil without source data, got %v", cpu0.SerialNumber)
 	}
 
 	cpu1 := cpus[1]
 	if cpu1.Socket == nil || *cpu1.Socket != 1 {
 		t.Errorf("cpu1 socket: got %v, want 1", cpu1.Socket)
 	}
-	if cpu1.SerialNumber == nil || *cpu1.SerialNumber != "CAR315KA0803B90-CPU-1" {
-		t.Errorf("cpu1 serial fallback: got %v, want CAR315KA0803B90-CPU-1", cpu1.SerialNumber)
+	if cpu1.SerialNumber != nil {
+		t.Errorf("cpu1 serial should stay nil without source data, got %v", cpu1.SerialNumber)
 	}
 }
 
 func TestParseCPUs_unpopulated_skipped(t *testing.T) {
 	out := mustReadFile(t, "testdata/dmidecode_type4_disabled.txt")
-	cpus := parseCPUs(out, "BOARD-001")
+	cpus := parseCPUs(out)
 
 	if len(cpus) != 1 {
 		t.Fatalf("expected 1 CPU (unpopulated skipped), got %d", len(cpus))
@@ -63,6 +64,39 @@ func TestParseCPUs_unpopulated_skipped(t *testing.T) {
 	}
 }
 
+func TestCollectCPUsSetsFirmwareFromMicrocode(t *testing.T) {
+	tmp := t.TempDir()
+	origBase := cpuSysBaseDir
+	cpuSysBaseDir = tmp
+	t.Cleanup(func() { cpuSysBaseDir = origBase })
+
+	if err := os.MkdirAll(filepath.Join(tmp, "cpu0", "microcode"), 0755); err != nil {
+		t.Fatalf("mkdir microcode dir: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(tmp, "cpu0", "microcode", "version"), []byte("0x2b000643\n"), 0644); err != nil {
+		t.Fatalf("write microcode version: %v", err)
+	}
+
+	origRun := execDmidecode
+	execDmidecode = func(typeNum string) (string, error) {
+		if typeNum != "4" {
+			t.Fatalf("unexpected dmidecode type: %s", typeNum)
+		}
+		return mustReadFile(t, "testdata/dmidecode_type4.txt"), nil
+	}
+	t.Cleanup(func() { execDmidecode = origRun })
+
+	cpus := collectCPUs()
+	if len(cpus) != 2 {
+		t.Fatalf("expected 2 CPUs, got %d", len(cpus))
+	}
+	for i, cpu := range cpus {
+		if cpu.Firmware == nil || *cpu.Firmware != "0x2b000643" {
+			t.Fatalf("cpu[%d] firmware=%v want microcode", i, cpu.Firmware)
+		}
+	}
+}
+
 func TestParseCPUStatus(t *testing.T) {
 	tests := []struct {
 		input string

audit/internal/collector/finalize.go

@@ -1,9 +1,6 @@
 package collector
 
-import (
-	"bee/audit/internal/schema"
-	"fmt"
-)
+import "bee/audit/internal/schema"
 
 func finalizeSnapshot(snap *schema.HardwareSnapshot, collectedAt string) {
 	snap.Memory = filterMemory(snap.Memory)
@@ -11,7 +8,6 @@ func finalizeSnapshot(snap *schema.HardwareSnapshot, collectedAt string) {
 	snap.PowerSupplies = filterPSUs(snap.PowerSupplies)
 
 	setComponentStatusMetadata(snap, collectedAt)
-	deduplicateComponentSerials(snap)
 }
 
 func filterMemory(dimms []schema.HardwareMemory) []schema.HardwareMemory {
@@ -45,7 +41,18 @@ func filterStorage(disks []schema.HardwareStorage) []schema.HardwareStorage {
 func filterPSUs(psus []schema.HardwarePowerSupply) []schema.HardwarePowerSupply {
 	out := make([]schema.HardwarePowerSupply, 0, len(psus))
 	for _, psu := range psus {
-		if psu.SerialNumber == nil || *psu.SerialNumber == "" {
+		hasIdentity := false
+		switch {
+		case psu.SerialNumber != nil && *psu.SerialNumber != "":
+			hasIdentity = true
+		case psu.Slot != nil && *psu.Slot != "":
+			hasIdentity = true
+		case psu.Model != nil && *psu.Model != "":
+			hasIdentity = true
+		case psu.Vendor != nil && *psu.Vendor != "":
+			hasIdentity = true
+		}
+		if !hasIdentity {
 			continue
 		}
 		out = append(out, psu)
@@ -79,101 +86,3 @@ func setStatusCheckedAt(status *schema.HardwareComponentStatus, collectedAt stri
 		status.StatusCheckedAt = &collectedAt
 	}
 }
-
-func deduplicateComponentSerials(snap *schema.HardwareSnapshot) {
-	deduplicateCPUSerials(snap.CPUs)
-	deduplicateMemorySerials(snap.Memory)
-	deduplicateStorageSerials(snap.Storage)
-	deduplicatePCIeSerials(snap.PCIeDevices)
-	deduplicatePSUSerials(snap.PowerSupplies)
-}
-
-func deduplicateCPUSerials(items []schema.HardwareCPU) {
-	seen := map[string]int{}
-	seq := 1
-	for i := range items {
-		if items[i].SerialNumber == nil || *items[i].SerialNumber == "" {
-			continue
-		}
-		model := derefString(items[i].Model)
-		key := model + "\x00" + *items[i].SerialNumber
-		seen[key]++
-		if seen[key] > 1 {
-			repl := fmt.Sprintf("NO_SN-%08d", seq)
-			seq++
-			items[i].SerialNumber = &repl
-		}
-	}
-}
-
-func deduplicateMemorySerials(items []schema.HardwareMemory) {
-	seen := map[string]int{}
-	seq := 1
-	for i := range items {
-		if items[i].SerialNumber == nil || *items[i].SerialNumber == "" {
-			continue
-		}
-		model := derefString(items[i].PartNumber)
-		key := model + "\x00" + *items[i].SerialNumber
-		seen[key]++
-		if seen[key] > 1 {
-			repl := fmt.Sprintf("NO_SN-%08d", seq)
-			seq++
-			items[i].SerialNumber = &repl
-		}
-	}
-}
-
-func deduplicateStorageSerials(items []schema.HardwareStorage) {
-	seen := map[string]int{}
-	seq := 1
-	for i := range items {
-		if items[i].SerialNumber == nil || *items[i].SerialNumber == "" {
-			continue
-		}
-		model := derefString(items[i].Model)
-		key := model + "\x00" + *items[i].SerialNumber
-		seen[key]++
-		if seen[key] > 1 {
-			repl := fmt.Sprintf("NO_SN-%08d", seq)
-			seq++
-			items[i].SerialNumber = &repl
-		}
-	}
-}
-
-func deduplicatePCIeSerials(items []schema.HardwarePCIeDevice) {
-	seen := map[string]int{}
-	seq := 1
-	for i := range items {
-		if items[i].SerialNumber == nil || *items[i].SerialNumber == "" {
-			continue
-		}
-		model := derefString(items[i].Model)
-		key := model + "\x00" + *items[i].SerialNumber
-		seen[key]++
-		if seen[key] > 1 {
-			repl := fmt.Sprintf("NO_SN-%08d", seq)
-			seq++
-			items[i].SerialNumber = &repl
-		}
-	}
-}
-
-func deduplicatePSUSerials(items []schema.HardwarePowerSupply) {
-	seen := map[string]int{}
-	seq := 1
-	for i := range items {
-		if items[i].SerialNumber == nil || *items[i].SerialNumber == "" {
-			continue
-		}
-		model := derefString(items[i].Model)
-		key := model + "\x00" + *items[i].SerialNumber
-		seen[key]++
-		if seen[key] > 1 {
-			repl := fmt.Sprintf("NO_SN-%08d", seq)
-			seq++
-			items[i].SerialNumber = &repl
-		}
-	}
-}

audit/internal/collector/finalize_test.go

@@ -39,7 +39,7 @@ func TestFinalizeSnapshotFiltersComponentsWithoutRequiredSerials(t *testing.T) {
 	}
 }
 
-func TestFinalizeSnapshotDeduplicatesSerials(t *testing.T) {
+func TestFinalizeSnapshotPreservesDuplicateSerials(t *testing.T) {
 	collectedAt := "2026-03-15T12:00:00Z"
 	status := statusOK
 	model := "Device"
@@ -57,7 +57,24 @@ func TestFinalizeSnapshotDeduplicatesSerials(t *testing.T) {
 	if got := *snap.Storage[0].SerialNumber; got != serial {
 		t.Fatalf("first serial changed: %q", got)
 	}
-	if got := *snap.Storage[1].SerialNumber; got != "NO_SN-00000001" {
-		t.Fatalf("duplicate serial mismatch: %q", got)
+	if got := *snap.Storage[1].SerialNumber; got != serial {
+		t.Fatalf("duplicate serial should stay unchanged: %q", got)
+	}
+}
+
+func TestFilterPSUsKeepsSlotOnlyEntries(t *testing.T) {
+	slot := "0"
+	status := statusOK
+
+	got := filterPSUs([]schema.HardwarePowerSupply{
+		{Slot: &slot, HardwareComponentStatus: schema.HardwareComponentStatus{Status: &status}},
+		{HardwareComponentStatus: schema.HardwareComponentStatus{Status: &status}},
+	})
+
+	if len(got) != 1 {
+		t.Fatalf("len(got)=%d want 1", len(got))
+	}
+	if got[0].Slot == nil || *got[0].Slot != "0" {
+		t.Fatalf("unexpected kept PSU: %+v", got[0])
 	}
 }

audit/internal/collector/nic_telemetry.go

@@ -44,6 +44,11 @@ func enrichPCIeWithNICTelemetry(devs []schema.HardwarePCIeDevice) []schema.Hardw
 		}
 		iface := ifaces[0]
 		devs[i].MacAddresses = collectInterfaceMACs(ifaces)
+		if devs[i].SerialNumber == nil {
+			if serial := queryPCIDeviceSerial(bdf); serial != "" {
+				devs[i].SerialNumber = &serial
+			}
+		}
 
 		if devs[i].Firmware == nil {
 			if out, err := ethtoolInfoQuery(iface); err == nil {

audit/internal/collector/nic_telemetry_test.go

@@ -1,6 +1,10 @@
 package collector
 
-import "testing"
+import (
+	"bee/audit/internal/schema"
+	"fmt"
+	"testing"
+)
 
 func TestParseSFPDOM(t *testing.T) {
 	raw := `
@@ -29,6 +33,74 @@ func TestParseSFPDOM(t *testing.T) {
 	}
 }
 
+func TestParseLSPCIDetailSerial(t *testing.T) {
+	raw := `
+05:00.0 Ethernet controller: Mellanox Technologies MT28908 Family [ConnectX-6]
+	Serial number: NIC-SN-12345
+`
+	if got := parseLSPCIDetailSerial(raw); got != "NIC-SN-12345" {
+		t.Fatalf("serial=%q want %q", got, "NIC-SN-12345")
+	}
+}
+
+func TestParsePCIVPDSerial(t *testing.T) {
+	raw := []byte{0x82, 0x05, 0x00, 'M', 'L', 'X', '5', 0x90, 0x08, 0x00, 'S', 'N', 0x08, 'M', 'T', '1', '2', '3', '4', '5', '6'}
+	if got := parsePCIVPDSerial(raw); got != "MT123456" {
+		t.Fatalf("serial=%q want %q", got, "MT123456")
+	}
+}
+
+func TestEnrichPCIeWithNICTelemetryAddsSerialFallback(t *testing.T) {
+	origDetail := queryPCILSPCIDetail
+	origVPD := readPCIVPDFile
+	origIfaces := netIfacesByBDF
+	origReadMAC := readNetAddressFile
+	origEth := ethtoolInfoQuery
+	origModule := ethtoolModuleQuery
+	t.Cleanup(func() {
+		queryPCILSPCIDetail = origDetail
+		readPCIVPDFile = origVPD
+		netIfacesByBDF = origIfaces
+		readNetAddressFile = origReadMAC
+		ethtoolInfoQuery = origEth
+		ethtoolModuleQuery = origModule
+	})
+
+	queryPCILSPCIDetail = func(bdf string) (string, error) {
+		if bdf != "0000:18:00.0" {
+			t.Fatalf("unexpected bdf: %s", bdf)
+		}
+		return "Serial number: NIC-SN-98765\n", nil
+	}
+	readPCIVPDFile = func(string) ([]byte, error) {
+		return nil, fmt.Errorf("no vpd needed")
+	}
+	netIfacesByBDF = func(string) []string { return []string{"eth0"} }
+	readNetAddressFile = func(iface string) (string, error) {
+		if iface != "eth0" {
+			t.Fatalf("unexpected iface: %s", iface)
+		}
+		return "aa:bb:cc:dd:ee:ff", nil
+	}
+	ethtoolInfoQuery = func(string) (string, error) { return "", fmt.Errorf("skip firmware") }
+	ethtoolModuleQuery = func(string) (string, error) { return "", fmt.Errorf("skip optics") }
+
+	class := "EthernetController"
+	bdf := "0000:18:00.0"
+	devs := []schema.HardwarePCIeDevice{{
+		DeviceClass: &class,
+		BDF:         &bdf,
+	}}
+
+	out := enrichPCIeWithNICTelemetry(devs)
+	if out[0].SerialNumber == nil || *out[0].SerialNumber != "NIC-SN-98765" {
+		t.Fatalf("serial=%v want NIC-SN-98765", out[0].SerialNumber)
+	}
+	if len(out[0].MacAddresses) != 1 || out[0].MacAddresses[0] != "aa:bb:cc:dd:ee:ff" {
+		t.Fatalf("mac_addresses=%v", out[0].MacAddresses)
+	}
+}
+
 func TestDBMValue(t *testing.T) {
 	tests := []struct {
 		in   string

audit/internal/collector/nvidia.go

@@ -24,18 +24,17 @@ type nvidiaGPUInfo struct {
 }
 
 // enrichPCIeWithNVIDIA enriches NVIDIA PCIe devices with data from nvidia-smi.
-// If the driver/tool is unavailable, NVIDIA devices get Unknown status and
-// a stable serial fallback based on board serial + slot.
-func enrichPCIeWithNVIDIA(devs []schema.HardwarePCIeDevice, boardSerial string) []schema.HardwarePCIeDevice {
+// If the driver/tool is unavailable, NVIDIA devices get Unknown status.
+func enrichPCIeWithNVIDIA(devs []schema.HardwarePCIeDevice) []schema.HardwarePCIeDevice {
 	if !hasNVIDIADevices(devs) {
 		return devs
 	}
 	gpuByBDF, err := queryNVIDIAGPUs()
 	if err != nil {
 		slog.Info("nvidia: enrichment skipped", "err", err)
-		return enrichPCIeWithNVIDIAData(devs, nil, boardSerial, false)
+		return enrichPCIeWithNVIDIAData(devs, nil, false)
 	}
-	return enrichPCIeWithNVIDIAData(devs, gpuByBDF, boardSerial, true)
+	return enrichPCIeWithNVIDIAData(devs, gpuByBDF, true)
 }
 
 func hasNVIDIADevices(devs []schema.HardwarePCIeDevice) bool {
@@ -47,7 +46,7 @@ func hasNVIDIADevices(devs []schema.HardwarePCIeDevice) bool {
 	return false
 }
 
-func enrichPCIeWithNVIDIAData(devs []schema.HardwarePCIeDevice, gpuByBDF map[string]nvidiaGPUInfo, boardSerial string, driverLoaded bool) []schema.HardwarePCIeDevice {
+func enrichPCIeWithNVIDIAData(devs []schema.HardwarePCIeDevice, gpuByBDF map[string]nvidiaGPUInfo, driverLoaded bool) []schema.HardwarePCIeDevice {
 	enriched := 0
 	for i := range devs {
 		if !isNVIDIADevice(devs[i]) {
@@ -55,7 +54,7 @@ func enrichPCIeWithNVIDIAData(devs []schema.HardwarePCIeDevice, gpuByBDF map[str
 		}
 
 		if !driverLoaded {
-			setPCIeFallback(&devs[i], boardSerial)
+			setPCIeFallback(&devs[i])
 			continue
 		}
 
@@ -65,14 +64,12 @@ func enrichPCIeWithNVIDIAData(devs []schema.HardwarePCIeDevice, gpuByBDF map[str
 		}
 		info, ok := gpuByBDF[bdf]
 		if !ok {
-			setPCIeFallback(&devs[i], boardSerial)
+			setPCIeFallback(&devs[i])
 			continue
 		}
 
 		if v := strings.TrimSpace(info.Serial); v != "" {
 			devs[i].SerialNumber = &v
-		} else {
-			setPCIeFallbackSerial(&devs[i], boardSerial)
 		}
 		if v := strings.TrimSpace(info.VBIOS); v != "" {
 			devs[i].Firmware = &v
@@ -213,26 +210,11 @@ func isNVIDIADevice(dev schema.HardwarePCIeDevice) bool {
 	return false
 }
 
-func setPCIeFallback(dev *schema.HardwarePCIeDevice, boardSerial string) {
-	setPCIeFallbackSerial(dev, boardSerial)
+func setPCIeFallback(dev *schema.HardwarePCIeDevice) {
 	status := statusUnknown
 	dev.Status = &status
 }
 
-func setPCIeFallbackSerial(dev *schema.HardwarePCIeDevice, boardSerial string) {
-	if strings.TrimSpace(boardSerial) == "" || dev.SerialNumber != nil {
-		return
-	}
-	slot := "unknown"
-	if dev.BDF != nil && strings.TrimSpace(*dev.BDF) != "" {
-		slot = strings.TrimSpace(*dev.BDF)
-	} else if dev.Slot != nil && strings.TrimSpace(*dev.Slot) != "" {
-		slot = strings.TrimSpace(*dev.Slot)
-	}
-	fb := fmt.Sprintf("%s-PCIE-%s", boardSerial, slot)
-	dev.SerialNumber = &fb
-}
-
 func injectNVIDIATelemetry(dev *schema.HardwarePCIeDevice, info nvidiaGPUInfo) {
 	if info.TemperatureC != nil {
 		dev.TemperatureC = info.TemperatureC

audit/internal/collector/nvidia_test.go

@@ -73,7 +73,7 @@ func TestEnrichPCIeWithNVIDIAData_driverLoaded(t *testing.T) {
 		},
 	}
 
-	out := enrichPCIeWithNVIDIAData(devices, byBDF, "BOARD-001", true)
+	out := enrichPCIeWithNVIDIAData(devices, byBDF, true)
 	if out[0].SerialNumber == nil || *out[0].SerialNumber != "GPU-ABC" {
 		t.Fatalf("serial: got %v", out[0].SerialNumber)
 	}
@@ -103,9 +103,9 @@ func TestEnrichPCIeWithNVIDIAData_driverMissingFallback(t *testing.T) {
 		},
 	}
 
-	out := enrichPCIeWithNVIDIAData(devices, nil, "BOARD-123", false)
-	if out[0].SerialNumber == nil || *out[0].SerialNumber != "BOARD-123-PCIE-0000:17:00.0" {
-		t.Fatalf("fallback serial: got %v", out[0].SerialNumber)
+	out := enrichPCIeWithNVIDIAData(devices, nil, false)
+	if out[0].SerialNumber != nil {
+		t.Fatalf("serial should stay nil without source data, got %v", out[0].SerialNumber)
 	}
 	if out[0].Status == nil || *out[0].Status != statusUnknown {
 		t.Fatalf("fallback status: got %v", out[0].Status)

audit/internal/collector/pcie.go

@@ -37,7 +37,7 @@ func parseLspci(output string) []schema.HardwarePCIeDevice {
 			val := strings.TrimSpace(line[idx+2:])
 			fields[key] = val
 		}
-		if !shouldIncludePCIeDevice(fields["Class"]) {
+		if !shouldIncludePCIeDevice(fields["Class"], fields["Vendor"], fields["Device"]) {
 			continue
 		}
 		dev := parseLspciDevice(fields)
@@ -46,8 +46,10 @@ func parseLspci(output string) []schema.HardwarePCIeDevice {
 	return devs
 }
 
-func shouldIncludePCIeDevice(class string) bool {
+func shouldIncludePCIeDevice(class, vendor, device string) bool {
 	c := strings.ToLower(strings.TrimSpace(class))
+	v := strings.ToLower(strings.TrimSpace(vendor))
+	d := strings.ToLower(strings.TrimSpace(device))
 	if c == "" {
 		return true
 	}
@@ -57,6 +59,8 @@ func shouldIncludePCIeDevice(class string) bool {
 		"host bridge",
 		"isa bridge",
 		"pci bridge",
+		"performance counter",
+		"performance counters",
 		"ram memory",
 		"system peripheral",
 		"communication controller",
@@ -66,12 +70,28 @@ func shouldIncludePCIeDevice(class string) bool {
 		"audio device",
 		"serial bus controller",
 		"unassigned class",
+		"non-essential instrumentation",
 	}
 	for _, bad := range excluded {
 		if strings.Contains(c, bad) {
 			return false
 		}
 	}
+
+	if strings.Contains(v, "advanced micro devices") || strings.Contains(v, "[amd]") {
+		internalAMDPatterns := []string{
+			"dummy function",
+			"reserved spp",
+			"ptdma",
+			"cryptographic coprocessor pspcpp",
+			"pspcpp",
+		}
+		for _, bad := range internalAMDPatterns {
+			if strings.Contains(d, bad) {
+				return false
+			}
+		}
+	}
 	return true
 }
 
@@ -84,6 +104,7 @@ func parseLspciDevice(fields map[string]string) schema.HardwarePCIeDevice {
 
 	// Slot is the BDF: "0000:00:02.0"
 	if bdf := fields["Slot"]; bdf != "" {
+		dev.Slot = &bdf
 		dev.BDF = &bdf
 		// parse vendor_id and device_id from sysfs
 		vendorID, deviceID := readPCIIDs(bdf)
@@ -95,6 +116,8 @@ func parseLspciDevice(fields map[string]string) schema.HardwarePCIeDevice {
 		}
 		if numaNode, ok := readPCINumaNode(bdf); ok {
 			dev.NUMANode = &numaNode
+		} else if numaNode, ok := parsePCINumaNode(fields["NUMANode"]); ok {
+			dev.NUMANode = &numaNode
 		}
 		if width, ok := readPCIIntAttribute(bdf, "current_link_width"); ok {
 			dev.LinkWidth = &width
@@ -162,6 +185,18 @@ func readPCINumaNode(bdf string) (int, bool) {
 	return value, true
 }
 
+func parsePCINumaNode(raw string) (int, bool) {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return 0, false
+	}
+	value, err := strconv.Atoi(raw)
+	if err != nil || value < 0 {
+		return 0, false
+	}
+	return value, true
+}
+
 func readPCIIntAttribute(bdf, attribute string) (int, bool) {
 	out, err := exec.Command("cat", "/sys/bus/pci/devices/"+bdf+"/"+attribute).Output()
 	if err != nil {

audit/internal/collector/pcie_filter_test.go

@@ -1,34 +1,49 @@
 package collector
 
-import "testing"
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+)
 
 func TestShouldIncludePCIeDevice(t *testing.T) {
 	tests := []struct {
-		class string
-		want  bool
+		name   string
+		class  string
+		vendor string
+		device string
+		want   bool
 	}{
-		{"USB controller", false},
-		{"System peripheral", false},
-		{"Audio device", false},
-		{"Host bridge", false},
-		{"PCI bridge", false},
-		{"SMBus", false},
-		{"Ethernet controller", true},
-		{"RAID bus controller", true},
-		{"Non-Volatile memory controller", true},
-		{"VGA compatible controller", true},
+		{name: "usb", class: "USB controller", want: false},
+		{name: "system peripheral", class: "System peripheral", want: false},
+		{name: "audio", class: "Audio device", want: false},
+		{name: "host bridge", class: "Host bridge", want: false},
+		{name: "pci bridge", class: "PCI bridge", want: false},
+		{name: "smbus", class: "SMBus", want: false},
+		{name: "perf", class: "Performance counters", want: false},
+		{name: "non essential instrumentation", class: "Non-Essential Instrumentation", want: false},
+		{name: "amd dummy function", class: "Encryption controller", vendor: "Advanced Micro Devices, Inc. [AMD]", device: "Starship/Matisse PTDMA", want: false},
+		{name: "amd pspcpp", class: "Encryption controller", vendor: "Advanced Micro Devices, Inc. [AMD]", device: "Starship/Matisse Cryptographic Coprocessor PSPCPP", want: false},
+		{name: "ethernet", class: "Ethernet controller", want: true},
+		{name: "raid", class: "RAID bus controller", want: true},
+		{name: "nvme", class: "Non-Volatile memory controller", want: true},
+		{name: "vga", class: "VGA compatible controller", want: true},
+		{name: "other encryption controller", class: "Encryption controller", vendor: "Intel Corporation", device: "QuickAssist", want: true},
 	}
 
 	for _, tt := range tests {
-		got := shouldIncludePCIeDevice(tt.class)
-		if got != tt.want {
-			t.Fatalf("class %q include=%v want %v", tt.class, got, tt.want)
-		}
+		t.Run(tt.name, func(t *testing.T) {
+			got := shouldIncludePCIeDevice(tt.class, tt.vendor, tt.device)
+			if got != tt.want {
+				t.Fatalf("class=%q vendor=%q device=%q include=%v want %v", tt.class, tt.vendor, tt.device, got, tt.want)
+			}
+		})
 	}
 }
 
 func TestParseLspci_filtersExcludedClasses(t *testing.T) {
 	input := "Slot:\t0000:00:14.0\nClass:\tUSB controller\nVendor:\tIntel Corporation\nDevice:\tUSB 3.0\n\n" +
+		"Slot:\t0000:00:18.0\nClass:\tNon-Essential Instrumentation\nVendor:\tAdvanced Micro Devices, Inc. [AMD]\nDevice:\tStarship/Matisse PCIe Dummy Function\n\n" +
 		"Slot:\t0000:65:00.0\nClass:\tVGA compatible controller\nVendor:\tNVIDIA Corporation\nDevice:\tH100\n\n"
 
 	devs := parseLspci(input)
@@ -38,6 +53,56 @@ func TestParseLspci_filtersExcludedClasses(t *testing.T) {
 	if devs[0].DeviceClass == nil || *devs[0].DeviceClass != "VideoController" {
 		t.Fatalf("unexpected remaining class: %v", devs[0].DeviceClass)
 	}
+	if devs[0].Slot == nil || *devs[0].Slot != "0000:65:00.0" {
+		t.Fatalf("slot: got %v", devs[0].Slot)
+	}
+	if devs[0].BDF == nil || *devs[0].BDF != "0000:65:00.0" {
+		t.Fatalf("bdf: got %v", devs[0].BDF)
+	}
+}
+
+func TestParseLspci_filtersAMDChipsetNoise(t *testing.T) {
+	input := "" +
+		"Slot:\t0000:1a:00.0\nClass:\tNon-Essential Instrumentation\nVendor:\tAdvanced Micro Devices, Inc. [AMD]\nDevice:\tStarship/Matisse PCIe Dummy Function\n\n" +
+		"Slot:\t0000:1a:00.2\nClass:\tEncryption controller\nVendor:\tAdvanced Micro Devices, Inc. [AMD]\nDevice:\tStarship/Matisse PTDMA\n\n" +
+		"Slot:\t0000:05:00.0\nClass:\tEthernet controller\nVendor:\tMellanox Technologies\nDevice:\tMT28908 Family [ConnectX-6]\n\n"
+
+	devs := parseLspci(input)
+	if len(devs) != 1 {
+		t.Fatalf("expected 1 remaining device, got %d", len(devs))
+	}
+	if devs[0].Model == nil || *devs[0].Model != "MT28908 Family [ConnectX-6]" {
+		t.Fatalf("unexpected remaining device: %+v", devs[0])
+	}
+}
+
+func TestPCIeJSONUsesSlotNotBDF(t *testing.T) {
+	input := "Slot:\t0000:65:00.0\nClass:\tVGA compatible controller\nVendor:\tNVIDIA Corporation\nDevice:\tH100\n\n"
+
+	devs := parseLspci(input)
+	data, err := json.Marshal(devs[0])
+	if err != nil {
+		t.Fatalf("marshal: %v", err)
+	}
+	text := string(data)
+	if !strings.Contains(text, `"slot":"0000:65:00.0"`) {
+		t.Fatalf("json missing slot: %s", text)
+	}
+	if strings.Contains(text, `"bdf"`) {
+		t.Fatalf("json should not emit bdf: %s", text)
+	}
+}
+
+func TestParseLspciUsesNUMANodeFieldWhenSysfsUnavailable(t *testing.T) {
+	input := "Slot:\t0000:65:00.0\nClass:\tEthernet controller\nVendor:\tIntel Corporation\nDevice:\tX710\nNUMANode:\t1\n\n"
+
+	devs := parseLspci(input)
+	if len(devs) != 1 {
+		t.Fatalf("expected 1 device, got %d", len(devs))
+	}
+	if devs[0].NUMANode == nil || *devs[0].NUMANode != 1 {
+		t.Fatalf("numa_node=%v want 1", devs[0].NUMANode)
+	}
 }
 
 func TestNormalizePCILinkSpeed(t *testing.T) {

audit/internal/collector/pcie_identity.go

@@ -0,0 +1,123 @@
+package collector
+
+import (
+	"bee/audit/internal/schema"
+	"log/slog"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+)
+
+var (
+	queryPCILSPCIDetail = func(bdf string) (string, error) {
+		out, err := exec.Command("lspci", "-vv", "-s", bdf).Output()
+		if err != nil {
+			return "", err
+		}
+		return string(out), nil
+	}
+	readPCIVPDFile = func(bdf string) ([]byte, error) {
+		return os.ReadFile(filepath.Join("/sys/bus/pci/devices", bdf, "vpd"))
+	}
+)
+
+func enrichPCIeWithPCISerials(devs []schema.HardwarePCIeDevice) []schema.HardwarePCIeDevice {
+	enriched := 0
+	for i := range devs {
+		if !shouldProbePCIeSerial(devs[i]) {
+			continue
+		}
+		bdf := normalizePCIeBDF(*devs[i].BDF)
+		if bdf == "" {
+			continue
+		}
+		if serial := queryPCIDeviceSerial(bdf); serial != "" {
+			devs[i].SerialNumber = &serial
+			enriched++
+		}
+	}
+	if enriched > 0 {
+		slog.Info("pcie: serials enriched", "count", enriched)
+	}
+	return devs
+}
+
+func shouldProbePCIeSerial(dev schema.HardwarePCIeDevice) bool {
+	if dev.BDF == nil || dev.SerialNumber != nil {
+		return false
+	}
+	if dev.DeviceClass == nil {
+		return false
+	}
+	class := strings.TrimSpace(*dev.DeviceClass)
+	return isNICClass(class) || isGPUClass(class)
+}
+
+func queryPCIDeviceSerial(bdf string) string {
+	if out, err := queryPCILSPCIDetail(bdf); err == nil {
+		if serial := parseLSPCIDetailSerial(out); serial != "" {
+			return serial
+		}
+	}
+	if raw, err := readPCIVPDFile(bdf); err == nil {
+		return parsePCIVPDSerial(raw)
+	}
+	return ""
+}
+
+func parseLSPCIDetailSerial(raw string) string {
+	for _, line := range strings.Split(raw, "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" {
+			continue
+		}
+		lower := strings.ToLower(line)
+		if !strings.Contains(lower, "serial number:") {
+			continue
+		}
+		idx := strings.Index(line, ":")
+		if idx < 0 {
+			continue
+		}
+		if serial := strings.TrimSpace(line[idx+1:]); serial != "" {
+			return serial
+		}
+	}
+	return ""
+}
+
+func parsePCIVPDSerial(raw []byte) string {
+	for i := 0; i+3 < len(raw); i++ {
+		if raw[i] != 'S' || raw[i+1] != 'N' {
+			continue
+		}
+		length := int(raw[i+2])
+		if length <= 0 || length > 64 || i+3+length > len(raw) {
+			continue
+		}
+		value := strings.TrimSpace(strings.Trim(string(raw[i+3:i+3+length]), "\x00"))
+		if !looksLikeSerial(value) {
+			continue
+		}
+		return value
+	}
+	return ""
+}
+
+func looksLikeSerial(value string) bool {
+	if len(value) < 4 {
+		return false
+	}
+	hasAlphaNum := false
+	for _, r := range value {
+		switch {
+		case r >= 'a' && r <= 'z', r >= 'A' && r <= 'Z', r >= '0' && r <= '9':
+			hasAlphaNum = true
+		case strings.ContainsRune(" -_./:", r):
+		default:
+			return false
+		}
+	}
+	return hasAlphaNum
+}

audit/internal/collector/pcie_identity_test.go

@@ -0,0 +1,47 @@
+package collector
+
+import (
+	"bee/audit/internal/schema"
+	"fmt"
+	"testing"
+)
+
+func TestEnrichPCIeWithPCISerialsAddsGPUFallback(t *testing.T) {
+	origDetail := queryPCILSPCIDetail
+	origVPD := readPCIVPDFile
+	t.Cleanup(func() {
+		queryPCILSPCIDetail = origDetail
+		readPCIVPDFile = origVPD
+	})
+
+	queryPCILSPCIDetail = func(bdf string) (string, error) {
+		if bdf != "0000:11:00.0" {
+			t.Fatalf("unexpected bdf: %s", bdf)
+		}
+		return "Serial number: GPU-SN-12345\n", nil
+	}
+	readPCIVPDFile = func(string) ([]byte, error) {
+		return nil, fmt.Errorf("no vpd needed")
+	}
+
+	class := "DisplayController"
+	bdf := "0000:11:00.0"
+	devs := []schema.HardwarePCIeDevice{{
+		DeviceClass: &class,
+		BDF:         &bdf,
+	}}
+
+	out := enrichPCIeWithPCISerials(devs)
+	if out[0].SerialNumber == nil || *out[0].SerialNumber != "GPU-SN-12345" {
+		t.Fatalf("serial=%v want GPU-SN-12345", out[0].SerialNumber)
+	}
+}
+
+func TestShouldProbePCIeSerialSkipsNonGPUOrNIC(t *testing.T) {
+	class := "StorageController"
+	bdf := "0000:19:00.0"
+	dev := schema.HardwarePCIeDevice{DeviceClass: &class, BDF: &bdf}
+	if shouldProbePCIeSerial(dev) {
+		t.Fatal("unexpected probe for storage controller")
+	}
+}

audit/internal/collector/psu.go

@@ -5,21 +5,31 @@ import (
 	"log/slog"
 	"os/exec"
 	"regexp"
+	"sort"
 	"strconv"
 	"strings"
 )
 
 func collectPSUs() []schema.HardwarePowerSupply {
-	// ipmitool requires /dev/ipmi0 — not available on non-server hardware
-	out, err := exec.Command("ipmitool", "fru", "print").Output()
-	if err != nil {
+	var psus []schema.HardwarePowerSupply
+	if out, err := exec.Command("ipmitool", "fru", "print").Output(); err == nil {
+		psus = parseFRU(string(out))
+	} else {
+		slog.Info("psu: fru unavailable", "err", err)
+	}
+
+	sdrData := map[int]psuSDR{}
+	if sdrOut, err := exec.Command("ipmitool", "sdr").Output(); err == nil {
+		sdrData = parsePSUSDR(string(sdrOut))
+		if len(psus) == 0 {
+			psus = synthesizePSUsFromSDR(sdrData)
+		} else {
+			mergePSUSDR(psus, sdrData)
+		}
+	} else if len(psus) == 0 {
 		slog.Info("psu: ipmitool unavailable, skipping", "err", err)
 		return nil
 	}
-	psus := parseFRU(string(out))
-	if sdrOut, err := exec.Command("ipmitool", "sdr").Output(); err == nil {
-		mergePSUSDR(psus, parsePSUSDR(string(sdrOut)))
-	}
 	slog.Info("psu: collected", "count", len(psus))
 	return psus
 }
@@ -79,9 +89,7 @@ func parseFRUBlock(block string, slotIdx int) (schema.HardwarePowerSupply, bool)
 
 	// Only process PSU FRU records
 	headerLower := strings.ToLower(header)
-	if !strings.Contains(headerLower, "psu") &&
-		!strings.Contains(headerLower, "power supply") &&
-		!strings.Contains(headerLower, "power_supply") {
+	if !isPSUHeader(headerLower) {
 		return schema.HardwarePowerSupply{}, false
 	}
 
@@ -89,21 +97,24 @@ func parseFRUBlock(block string, slotIdx int) (schema.HardwarePowerSupply, bool)
 	psu := schema.HardwarePowerSupply{Present: &present}
 
 	slotStr := strconv.Itoa(slotIdx)
+	if slot, ok := parsePSUSlot(header); ok && slot > 0 {
+		slotStr = strconv.Itoa(slot - 1)
+	}
 	psu.Slot = &slotStr
 
-	if v := cleanDMIValue(fields["Board Product"]); v != "" {
+	if v := firstNonEmptyField(fields, "Board Product", "Product Name", "Product Part Number"); v != "" {
 		psu.Model = &v
 	}
-	if v := cleanDMIValue(fields["Board Mfg"]); v != "" {
+	if v := firstNonEmptyField(fields, "Board Mfg", "Product Manufacturer", "Product Manufacturer Name"); v != "" {
 		psu.Vendor = &v
 	}
-	if v := cleanDMIValue(fields["Board Serial"]); v != "" {
+	if v := firstNonEmptyField(fields, "Board Serial", "Product Serial", "Product Serial Number"); v != "" {
 		psu.SerialNumber = &v
 	}
-	if v := cleanDMIValue(fields["Board Part Number"]); v != "" {
+	if v := firstNonEmptyField(fields, "Board Part Number", "Product Part Number", "Part Number"); v != "" {
 		psu.PartNumber = &v
 	}
-	if v := cleanDMIValue(fields["Board Extra"]); v != "" {
+	if v := firstNonEmptyField(fields, "Board Extra", "Product Version", "Board Version"); v != "" {
 		psu.Firmware = &v
 	}
 
@@ -120,6 +131,23 @@ func parseFRUBlock(block string, slotIdx int) (schema.HardwarePowerSupply, bool)
 	return psu, true
 }
 
+func isPSUHeader(headerLower string) bool {
+	return strings.Contains(headerLower, "psu") ||
+		strings.Contains(headerLower, "pws") ||
+		strings.Contains(headerLower, "power supply") ||
+		strings.Contains(headerLower, "power_supply") ||
+		strings.Contains(headerLower, "power module")
+}
+
+func firstNonEmptyField(fields map[string]string, keys ...string) string {
+	for _, key := range keys {
+		if value := cleanDMIValue(fields[key]); value != "" {
+			return value
+		}
+	}
+	return ""
+}
+
 type psuSDR struct {
 	slot         int
 	status       string
@@ -131,7 +159,13 @@ type psuSDR struct {
 	healthPct    *float64
 }
 
-var psuSlotRe = regexp.MustCompile(`(?i)\bpsu?\s*([0-9]+)\b|\bps\s*([0-9]+)\b`)
+var psuSlotPatterns = []*regexp.Regexp{
+	regexp.MustCompile(`(?i)\bpsu?\s*([0-9]+)\b`),
+	regexp.MustCompile(`(?i)\bps\s*([0-9]+)\b`),
+	regexp.MustCompile(`(?i)\bpws\s*([0-9]+)\b`),
+	regexp.MustCompile(`(?i)\bpower\s*supply(?:\s*bay)?\s*([0-9]+)\b`),
+	regexp.MustCompile(`(?i)\bbay\s*([0-9]+)\b`),
+}
 
 func parsePSUSDR(raw string) map[int]psuSDR {
 	out := map[int]psuSDR{}
@@ -164,6 +198,8 @@ func parsePSUSDR(raw string) map[int]psuSDR {
 			entry.inputPowerW = parseFloatPtr(value)
 		case strings.Contains(lowerName, "output power"):
 			entry.outputPowerW = parseFloatPtr(value)
+		case strings.Contains(lowerName, "power supply bay"), strings.Contains(lowerName, "psu bay"):
+			entry.outputPowerW = parseFloatPtr(value)
 		case strings.Contains(lowerName, "input voltage"), strings.Contains(lowerName, "ac input"):
 			entry.inputVoltage = parseFloatPtr(value)
 		case strings.Contains(lowerName, "temp"):
@@ -176,6 +212,49 @@ func parsePSUSDR(raw string) map[int]psuSDR {
 	return out
 }
 
+func synthesizePSUsFromSDR(sdr map[int]psuSDR) []schema.HardwarePowerSupply {
+	if len(sdr) == 0 {
+		return nil
+	}
+	slots := make([]int, 0, len(sdr))
+	for slot := range sdr {
+		slots = append(slots, slot)
+	}
+	sort.Ints(slots)
+
+	out := make([]schema.HardwarePowerSupply, 0, len(slots))
+	for _, slot := range slots {
+		entry := sdr[slot]
+		present := true
+		status := entry.status
+		if status == "" {
+			status = statusUnknown
+		}
+		slotStr := strconv.Itoa(slot - 1)
+		model := "PSU"
+		psu := schema.HardwarePowerSupply{
+			HardwareComponentStatus: schema.HardwareComponentStatus{Status: &status},
+			Slot:                    &slotStr,
+			Present:                 &present,
+			Model:                   &model,
+			InputPowerW:             entry.inputPowerW,
+			OutputPowerW:            entry.outputPowerW,
+			InputVoltage:            entry.inputVoltage,
+			TemperatureC:            entry.temperatureC,
+		}
+		if entry.healthPct != nil {
+			psu.LifeRemainingPct = entry.healthPct
+			lifeUsed := 100 - *entry.healthPct
+			psu.LifeUsedPct = &lifeUsed
+		}
+		if entry.reason != "" {
+			psu.ErrorDescription = &entry.reason
+		}
+		out = append(out, psu)
+	}
+	return out
+}
+
 func mergePSUSDR(psus []schema.HardwarePowerSupply, sdr map[int]psuSDR) {
 	for i := range psus {
 		slotIdx, err := strconv.Atoi(derefPSUSlot(psus[i].Slot))
@@ -231,17 +310,19 @@ func splitSDRFields(line string) []string {
 }
 
 func parsePSUSlot(name string) (int, bool) {
-	m := psuSlotRe.FindStringSubmatch(strings.ToLower(name))
-	if len(m) == 0 {
-		return 0, false
-	}
-	for _, group := range m[1:] {
-		if group == "" {
+	for _, re := range psuSlotPatterns {
+		m := re.FindStringSubmatch(strings.ToLower(name))
+		if len(m) == 0 {
 			continue
 		}
-		n, err := strconv.Atoi(group)
-		if err == nil && n > 0 {
-			return n, true
+		for _, group := range m[1:] {
+			if group == "" {
+				continue
+			}
+			n, err := strconv.Atoi(group)
+			if err == nil && n > 0 {
+				return n, true
+			}
 		}
 	}
 	return 0, false

audit/internal/collector/psu_sdr_test.go

@@ -38,3 +38,54 @@ PS2 Input Power   | 0 Watts   | cr
 		t.Fatalf("ps2 status=%q", got[2].status)
 	}
 }
+
+func TestParsePSUSlotVendorVariants(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name string
+		want int
+	}{
+		{name: "PWS1 Status", want: 1},
+		{name: "Power Supply Bay 8", want: 8},
+		{name: "PS 6 Input Power", want: 6},
+	}
+
+	for _, tt := range tests {
+		got, ok := parsePSUSlot(tt.name)
+		if !ok || got != tt.want {
+			t.Fatalf("parsePSUSlot(%q)=(%d,%v) want (%d,true)", tt.name, got, ok, tt.want)
+		}
+	}
+}
+
+func TestSynthesizePSUsFromSDR(t *testing.T) {
+	t.Parallel()
+
+	health := 97.0
+	outputPower := 915.0
+	got := synthesizePSUsFromSDR(map[int]psuSDR{
+		1: {
+			slot:         1,
+			status:       statusOK,
+			outputPowerW: &outputPower,
+			healthPct:    &health,
+		},
+	})
+
+	if len(got) != 1 {
+		t.Fatalf("len(got)=%d want 1", len(got))
+	}
+	if got[0].Slot == nil || *got[0].Slot != "0" {
+		t.Fatalf("slot=%v want 0", got[0].Slot)
+	}
+	if got[0].OutputPowerW == nil || *got[0].OutputPowerW != 915 {
+		t.Fatalf("output power=%v", got[0].OutputPowerW)
+	}
+	if got[0].LifeRemainingPct == nil || *got[0].LifeRemainingPct != 97 {
+		t.Fatalf("life remaining=%v", got[0].LifeRemainingPct)
+	}
+	if got[0].LifeUsedPct == nil || *got[0].LifeUsedPct != 3 {
+		t.Fatalf("life used=%v", got[0].LifeUsedPct)
+	}
+}

audit/internal/collector/psu_telemetry.go

@@ -113,19 +113,8 @@ func isLikelyPSUTemp(chip, feature string) bool {
 
 func detectPSUSlot(parts ...string) (string, bool) {
 	for _, part := range parts {
-		lower := strings.ToLower(part)
-		matches := psuSlotRe.FindStringSubmatch(lower)
-		if len(matches) == 0 {
-			continue
-		}
-		for _, group := range matches[1:] {
-			if group == "" {
-				continue
-			}
-			value, err := strconv.Atoi(group)
-			if err == nil && value > 0 {
-				return strconv.Itoa(value - 1), true
-			}
+		if value, ok := parsePSUSlot(part); ok && value > 0 {
+			return strconv.Itoa(value - 1), true
 		}
 	}
 	return "", false

audit/internal/collector/storage.go

@@ -5,11 +5,13 @@ import (
 	"encoding/json"
 	"log/slog"
 	"os/exec"
+	"path/filepath"
+	"strconv"
 	"strings"
 )
 
 func collectStorage() []schema.HardwareStorage {
-	devs := lsblkDevices()
+	devs := discoverStorageDevices()
 	result := make([]schema.HardwareStorage, 0, len(devs))
 	for _, dev := range devs {
 		var s schema.HardwareStorage
@@ -39,6 +41,47 @@ type lsblkRoot struct {
 	Blockdevices []lsblkDevice `json:"blockdevices"`
 }
 
+type nvmeListRoot struct {
+	Devices []nvmeListDevice `json:"Devices"`
+}
+
+type nvmeListDevice struct {
+	DevicePath   string `json:"DevicePath"`
+	ModelNumber  string `json:"ModelNumber"`
+	SerialNumber string `json:"SerialNumber"`
+	Firmware     string `json:"Firmware"`
+	PhysicalSize int64  `json:"PhysicalSize"`
+}
+
+func discoverStorageDevices() []lsblkDevice {
+	merged := map[string]lsblkDevice{}
+	for _, dev := range lsblkDevices() {
+		if dev.Name == "" {
+			continue
+		}
+		merged[dev.Name] = dev
+	}
+	for _, dev := range nvmeListDevices() {
+		if dev.Name == "" {
+			continue
+		}
+		current := merged[dev.Name]
+		merged[dev.Name] = mergeStorageDevice(current, dev)
+	}
+
+	disks := make([]lsblkDevice, 0, len(merged))
+	for _, dev := range merged {
+		if dev.Type == "" {
+			dev.Type = "disk"
+		}
+		if dev.Type != "disk" {
+			continue
+		}
+		disks = append(disks, dev)
+	}
+	return disks
+}
+
 func lsblkDevices() []lsblkDevice {
 	out, err := exec.Command("lsblk", "-J", "-d",
 		"-o", "NAME,TYPE,SIZE,SERIAL,MODEL,TRAN,HCTL").Output()
@@ -60,6 +103,59 @@ func lsblkDevices() []lsblkDevice {
 	return disks
 }
 
+func nvmeListDevices() []lsblkDevice {
+	out, err := exec.Command("nvme", "list", "-o", "json").Output()
+	if err != nil {
+		return nil
+	}
+	var root nvmeListRoot
+	if err := json.Unmarshal(out, &root); err != nil {
+		slog.Warn("storage: nvme list parse failed", "err", err)
+		return nil
+	}
+	devices := make([]lsblkDevice, 0, len(root.Devices))
+	for _, dev := range root.Devices {
+		name := filepath.Base(strings.TrimSpace(dev.DevicePath))
+		if name == "" {
+			continue
+		}
+		devices = append(devices, lsblkDevice{
+			Name:   name,
+			Type:   "disk",
+			Size:   strconv.FormatInt(dev.PhysicalSize, 10),
+			Serial: strings.TrimSpace(dev.SerialNumber),
+			Model:  strings.TrimSpace(dev.ModelNumber),
+			Tran:   "nvme",
+		})
+	}
+	return devices
+}
+
+func mergeStorageDevice(existing, incoming lsblkDevice) lsblkDevice {
+	if existing.Name == "" {
+		return incoming
+	}
+	if existing.Type == "" {
+		existing.Type = incoming.Type
+	}
+	if strings.TrimSpace(existing.Size) == "" {
+		existing.Size = incoming.Size
+	}
+	if strings.TrimSpace(existing.Serial) == "" {
+		existing.Serial = incoming.Serial
+	}
+	if strings.TrimSpace(existing.Model) == "" {
+		existing.Model = incoming.Model
+	}
+	if strings.TrimSpace(existing.Tran) == "" {
+		existing.Tran = incoming.Tran
+	}
+	if strings.TrimSpace(existing.Hctl) == "" {
+		existing.Hctl = incoming.Hctl
+	}
+	return existing
+}
+
 // smartctlInfo is the subset of smartctl -j -a output we care about.
 type smartctlInfo struct {
 	ModelFamily  string `json:"model_family"`
@@ -255,6 +351,18 @@ func enrichWithNVMe(dev lsblkDevice) schema.HardwareStorage {
 	}
 
 	devPath := "/dev/" + dev.Name
+	if v := cleanDMIValue(strings.TrimSpace(dev.Model)); v != "" {
+		s.Model = &v
+	}
+	if v := cleanDMIValue(strings.TrimSpace(dev.Serial)); v != "" {
+		s.SerialNumber = &v
+	}
+	if size := parseStorageBytes(dev.Size); size > 0 {
+		gb := int(size / 1_000_000_000)
+		if gb > 0 {
+			s.SizeGB = &gb
+		}
+	}
 
 	// id-ctrl: model, serial, firmware, capacity
 	if out, err := exec.Command("nvme", "id-ctrl", devPath, "-o", "json").Output(); err == nil {
@@ -335,6 +443,14 @@ func enrichWithNVMe(dev lsblkDevice) schema.HardwareStorage {
 	return s
 }
 
+func parseStorageBytes(raw string) int64 {
+	value, err := strconv.ParseInt(strings.TrimSpace(raw), 10, 64)
+	if err == nil && value > 0 {
+		return value
+	}
+	return 0
+}
+
 func nvmeDataUnitsToBytes(units int64) int64 {
 	if units <= 0 {
 		return 0

audit/internal/collector/storage_discovery_test.go

@@ -0,0 +1,33 @@
+package collector
+
+import "testing"
+
+func TestMergeStorageDevicePrefersNonEmptyFields(t *testing.T) {
+	t.Parallel()
+
+	got := mergeStorageDevice(
+		lsblkDevice{Name: "nvme0n1", Type: "disk", Tran: "nvme"},
+		lsblkDevice{Name: "nvme0n1", Type: "disk", Size: "1024", Serial: "SN123", Model: "Kioxia"},
+	)
+
+	if got.Serial != "SN123" {
+		t.Fatalf("serial=%q want SN123", got.Serial)
+	}
+	if got.Model != "Kioxia" {
+		t.Fatalf("model=%q want Kioxia", got.Model)
+	}
+	if got.Size != "1024" {
+		t.Fatalf("size=%q want 1024", got.Size)
+	}
+}
+
+func TestParseStorageBytes(t *testing.T) {
+	t.Parallel()
+
+	if got := parseStorageBytes(" 2048 "); got != 2048 {
+		t.Fatalf("parseStorageBytes=%d want 2048", got)
+	}
+	if got := parseStorageBytes("1.92 TB"); got != 0 {
+		t.Fatalf("parseStorageBytes invalid=%d want 0", got)
+	}
+}

audit/internal/platform/export.go

@@ -9,8 +9,10 @@ import (
 	"strings"
 )
 
+var exportExecCommand = exec.Command
+
 func (s *System) ListRemovableTargets() ([]RemovableTarget, error) {
-	raw, err := exec.Command("lsblk", "-P", "-o", "NAME,TYPE,PKNAME,RM,FSTYPE,MOUNTPOINT,SIZE,LABEL,MODEL").Output()
+	raw, err := exportExecCommand("lsblk", "-P", "-o", "NAME,TYPE,PKNAME,RM,FSTYPE,MOUNTPOINT,SIZE,LABEL,MODEL").Output()
 	if err != nil {
 		return nil, err
 	}
@@ -52,7 +54,7 @@ func (s *System) ListRemovableTargets() ([]RemovableTarget, error) {
 	return out, nil
 }
 
-func (s *System) ExportFileToTarget(src string, target RemovableTarget) (string, error) {
+func (s *System) ExportFileToTarget(src string, target RemovableTarget) (dst string, retErr error) {
 	if src == "" || target.Device == "" {
 		return "", fmt.Errorf("source and target are required")
 	}
@@ -62,20 +64,39 @@ func (s *System) ExportFileToTarget(src string, target RemovableTarget) (string,
 
 	mountpoint := strings.TrimSpace(target.Mountpoint)
 	mountedHere := false
+	mounted := mountpoint != ""
 	if mountpoint == "" {
 		mountpoint = filepath.Join("/tmp", "bee-export-"+filepath.Base(target.Device))
 		if err := os.MkdirAll(mountpoint, 0755); err != nil {
 			return "", err
 		}
-		if raw, err := exec.Command("mount", target.Device, mountpoint).CombinedOutput(); err != nil {
+		if raw, err := exportExecCommand("mount", target.Device, mountpoint).CombinedOutput(); err != nil {
 			_ = os.Remove(mountpoint)
 			return string(raw), err
 		}
 		mountedHere = true
+		mounted = true
 	}
+	defer func() {
+		if !mounted {
+			return
+		}
+		_ = exportExecCommand("sync").Run()
+		if raw, err := exportExecCommand("umount", mountpoint).CombinedOutput(); err != nil && retErr == nil {
+			msg := strings.TrimSpace(string(raw))
+			if msg == "" {
+				retErr = err
+			} else {
+				retErr = fmt.Errorf("%s: %w", msg, err)
+			}
+		}
+		if mountedHere {
+			_ = os.Remove(mountpoint)
+		}
+	}()
 
 	filename := filepath.Base(src)
-	dst := filepath.Join(mountpoint, filename)
+	dst = filepath.Join(mountpoint, filename)
 	data, err := os.ReadFile(src)
 	if err != nil {
 		return "", err
@@ -83,12 +104,6 @@ func (s *System) ExportFileToTarget(src string, target RemovableTarget) (string,
 	if err := os.WriteFile(dst, data, 0644); err != nil {
 		return "", err
 	}
-	_ = exec.Command("sync").Run()
-
-	if mountedHere {
-		_ = exec.Command("umount", mountpoint).Run()
-		_ = os.Remove(mountpoint)
-	}
 
 	return dst, nil
 }

audit/internal/platform/export_test.go

@@ -0,0 +1,56 @@
+package platform
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"testing"
+)
+
+func TestExportFileToTargetUnmountsExistingMountpoint(t *testing.T) {
+	t.Parallel()
+
+	tmp := t.TempDir()
+	src := filepath.Join(tmp, "bundle.tar.gz")
+	mountpoint := filepath.Join(tmp, "mnt")
+	if err := os.MkdirAll(mountpoint, 0755); err != nil {
+		t.Fatalf("mkdir mountpoint: %v", err)
+	}
+	if err := os.WriteFile(src, []byte("bundle"), 0644); err != nil {
+		t.Fatalf("write src: %v", err)
+	}
+
+	var calls [][]string
+	oldExec := exportExecCommand
+	exportExecCommand = func(name string, args ...string) *exec.Cmd {
+		calls = append(calls, append([]string{name}, args...))
+		return exec.Command("sh", "-c", "exit 0")
+	}
+	t.Cleanup(func() { exportExecCommand = oldExec })
+
+	s := &System{}
+	dst, err := s.ExportFileToTarget(src, RemovableTarget{
+		Device:     "/dev/sdb1",
+		Mountpoint: mountpoint,
+	})
+	if err != nil {
+		t.Fatalf("ExportFileToTarget error: %v", err)
+	}
+	if got, want := dst, filepath.Join(mountpoint, "bundle.tar.gz"); got != want {
+		t.Fatalf("dst=%q want %q", got, want)
+	}
+	if _, err := os.Stat(filepath.Join(mountpoint, "bundle.tar.gz")); err != nil {
+		t.Fatalf("exported file missing: %v", err)
+	}
+
+	foundUmount := false
+	for _, call := range calls {
+		if len(call) == 2 && call[0] == "umount" && call[1] == mountpoint {
+			foundUmount = true
+			break
+		}
+	}
+	if !foundUmount {
+		t.Fatalf("expected umount %q call, got %#v", mountpoint, calls)
+	}
+}

audit/internal/platform/gpu_metrics.go

@@ -0,0 +1,577 @@
+package platform
+
+import (
+	"bytes"
+	"fmt"
+	"math"
+	"os"
+	"os/exec"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// GPUMetricRow is one telemetry sample from nvidia-smi during a stress test.
+type GPUMetricRow struct {
+	ElapsedSec float64
+	GPUIndex   int
+	TempC      float64
+	UsagePct   float64
+	PowerW     float64
+	ClockMHz   float64
+}
+
+// sampleGPUMetrics runs nvidia-smi once and returns current metrics for each GPU.
+func sampleGPUMetrics(gpuIndices []int) ([]GPUMetricRow, error) {
+	args := []string{
+		"--query-gpu=index,temperature.gpu,utilization.gpu,power.draw,clocks.current.graphics",
+		"--format=csv,noheader,nounits",
+	}
+	if len(gpuIndices) > 0 {
+		ids := make([]string, len(gpuIndices))
+		for i, idx := range gpuIndices {
+			ids[i] = strconv.Itoa(idx)
+		}
+		args = append([]string{"--id=" + strings.Join(ids, ",")}, args...)
+	}
+	out, err := exec.Command("nvidia-smi", args...).Output()
+	if err != nil {
+		return nil, err
+	}
+	var rows []GPUMetricRow
+	for _, line := range strings.Split(strings.TrimSpace(string(out)), "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" {
+			continue
+		}
+		parts := strings.Split(line, ", ")
+		if len(parts) < 5 {
+			continue
+		}
+		idx, _ := strconv.Atoi(strings.TrimSpace(parts[0]))
+		rows = append(rows, GPUMetricRow{
+			GPUIndex: idx,
+			TempC:    parseGPUFloat(parts[1]),
+			UsagePct: parseGPUFloat(parts[2]),
+			PowerW:   parseGPUFloat(parts[3]),
+			ClockMHz: parseGPUFloat(parts[4]),
+		})
+	}
+	return rows, nil
+}
+
+func parseGPUFloat(s string) float64 {
+	s = strings.TrimSpace(s)
+	if s == "N/A" || s == "[Not Supported]" || s == "" {
+		return 0
+	}
+	v, _ := strconv.ParseFloat(s, 64)
+	return v
+}
+
+// WriteGPUMetricsCSV writes collected rows as a CSV file.
+func WriteGPUMetricsCSV(path string, rows []GPUMetricRow) error {
+	var b bytes.Buffer
+	b.WriteString("elapsed_sec,gpu_index,temperature_c,usage_pct,power_w,clock_mhz\n")
+	for _, r := range rows {
+		fmt.Fprintf(&b, "%.1f,%d,%.1f,%.1f,%.1f,%.0f\n",
+			r.ElapsedSec, r.GPUIndex, r.TempC, r.UsagePct, r.PowerW, r.ClockMHz)
+	}
+	return os.WriteFile(path, b.Bytes(), 0644)
+}
+
+// WriteGPUMetricsHTML writes a standalone HTML file with one SVG chart per GPU.
+func WriteGPUMetricsHTML(path string, rows []GPUMetricRow) error {
+	// Group by GPU index preserving order.
+	seen := make(map[int]bool)
+	var order []int
+	gpuMap := make(map[int][]GPUMetricRow)
+	for _, r := range rows {
+		if !seen[r.GPUIndex] {
+			seen[r.GPUIndex] = true
+			order = append(order, r.GPUIndex)
+		}
+		gpuMap[r.GPUIndex] = append(gpuMap[r.GPUIndex], r)
+	}
+
+	var svgs strings.Builder
+	for _, gpuIdx := range order {
+		svgs.WriteString(drawGPUChartSVG(gpuMap[gpuIdx], gpuIdx))
+		svgs.WriteString("\n")
+	}
+
+	ts := time.Now().UTC().Format("2006-01-02 15:04:05 UTC")
+	html := fmt.Sprintf(`<!DOCTYPE html>
+<html><head>
+<meta charset="utf-8">
+<title>GPU Stress Test Metrics</title>
+<style>
+body { font-family: sans-serif; background: #f0f0f0; margin: 0; padding: 20px; }
+h1 { text-align: center; color: #333; margin: 0 0 8px; }
+p  { text-align: center; color: #888; font-size: 13px; margin: 0 0 24px; }
+</style>
+</head><body>
+<h1>GPU Stress Test Metrics</h1>
+<p>Generated %s</p>
+%s
+</body></html>`, ts, svgs.String())
+
+	return os.WriteFile(path, []byte(html), 0644)
+}
+
+// drawGPUChartSVG generates a self-contained SVG chart for one GPU.
+func drawGPUChartSVG(rows []GPUMetricRow, gpuIdx int) string {
+	// Layout
+	const W, H = 960, 520
+	const plotX1 = 120 // usage axis / chart left border
+	const plotX2 = 840 // power axis / chart right border
+	const plotY1 = 70  // top
+	const plotY2 = 465 // bottom  (PH = 395)
+	const PW = plotX2 - plotX1
+	const PH = plotY2 - plotY1
+	// Outer axes
+	const tempAxisX = 60  // temp axis line
+	const clockAxisX = 900 // clock axis line
+
+	colors := [4]string{"#e74c3c", "#3498db", "#2ecc71", "#f39c12"}
+	seriesLabel := [4]string{
+		fmt.Sprintf("GPU %d Temp (°C)", gpuIdx),
+		fmt.Sprintf("GPU %d Usage (%%)", gpuIdx),
+		fmt.Sprintf("GPU %d Power (W)", gpuIdx),
+		fmt.Sprintf("GPU %d Clock (MHz)", gpuIdx),
+	}
+	axisLabel := [4]string{"Temperature (°C)", "GPU Usage (%)", "Power (W)", "Clock (MHz)"}
+
+	// Extract series
+	t := make([]float64, len(rows))
+	vals := [4][]float64{}
+	for i := range vals {
+		vals[i] = make([]float64, len(rows))
+	}
+	for i, r := range rows {
+		t[i] = r.ElapsedSec
+		vals[0][i] = r.TempC
+		vals[1][i] = r.UsagePct
+		vals[2][i] = r.PowerW
+		vals[3][i] = r.ClockMHz
+	}
+
+	tMin, tMax := gpuMinMax(t)
+	type axisScale struct {
+		ticks    []float64
+		min, max float64
+	}
+	var axes [4]axisScale
+	for i := 0; i < 4; i++ {
+		mn, mx := gpuMinMax(vals[i])
+		tks := gpuNiceTicks(mn, mx, 8)
+		axes[i] = axisScale{ticks: tks, min: tks[0], max: tks[len(tks)-1]}
+	}
+
+	xv := func(tv float64) float64 {
+		if tMax == tMin {
+			return float64(plotX1)
+		}
+		return float64(plotX1) + (tv-tMin)/(tMax-tMin)*float64(PW)
+	}
+	yv := func(v float64, ai int) float64 {
+		a := axes[ai]
+		if a.max == a.min {
+			return float64(plotY1 + PH/2)
+		}
+		return float64(plotY2) - (v-a.min)/(a.max-a.min)*float64(PH)
+	}
+
+	var b strings.Builder
+
+	fmt.Fprintf(&b, `<svg xmlns="http://www.w3.org/2000/svg" width="%d" height="%d"`+
+		` style="background:#fff;border-radius:8px;display:block;margin:0 auto 24px;`+
+		`box-shadow:0 2px 12px rgba(0,0,0,.12)">`+"\n", W, H)
+
+	// Title
+	fmt.Fprintf(&b, `<text x="%d" y="22" text-anchor="middle" font-family="sans-serif"`+
+		` font-size="14" font-weight="bold" fill="#333">GPU Stress Test Metrics — GPU %d</text>`+"\n",
+		plotX1+PW/2, gpuIdx)
+
+	// Horizontal grid (align to temp axis ticks)
+	b.WriteString(`<g stroke="#e0e0e0" stroke-width="0.5">` + "\n")
+	for _, tick := range axes[0].ticks {
+		y := yv(tick, 0)
+		if y < float64(plotY1) || y > float64(plotY2) {
+			continue
+		}
+		fmt.Fprintf(&b, `<line x1="%d" y1="%.1f" x2="%d" y2="%.1f"/>`+"\n",
+			plotX1, y, plotX2, y)
+	}
+	// Vertical grid
+	xTicks := gpuNiceTicks(tMin, tMax, 10)
+	for _, tv := range xTicks {
+		x := xv(tv)
+		if x < float64(plotX1) || x > float64(plotX2) {
+			continue
+		}
+		fmt.Fprintf(&b, `<line x1="%.1f" y1="%d" x2="%.1f" y2="%d"/>`+"\n",
+			x, plotY1, x, plotY2)
+	}
+	b.WriteString("</g>\n")
+
+	// Chart border
+	fmt.Fprintf(&b, `<rect x="%d" y="%d" width="%d" height="%d"`+
+		` fill="none" stroke="#333" stroke-width="1"/>`+"\n",
+		plotX1, plotY1, PW, PH)
+
+	// X axis ticks and labels
+	b.WriteString(`<g font-family="sans-serif" font-size="11" fill="#333" text-anchor="middle">` + "\n")
+	for _, tv := range xTicks {
+		x := xv(tv)
+		if x < float64(plotX1) || x > float64(plotX2) {
+			continue
+		}
+		fmt.Fprintf(&b, `<text x="%.1f" y="%d">%s</text>`+"\n", x, plotY2+18, gpuFormatTick(tv))
+		fmt.Fprintf(&b, `<line x1="%.1f" y1="%d" x2="%.1f" y2="%d" stroke="#333" stroke-width="1"/>`+"\n",
+			x, plotY2, x, plotY2+4)
+	}
+	b.WriteString("</g>\n")
+	fmt.Fprintf(&b, `<text x="%d" y="%d" font-family="sans-serif" font-size="13"`+
+		` fill="#333" text-anchor="middle">Time (seconds)</text>`+"\n",
+		plotX1+PW/2, plotY2+38)
+
+	// Y axes: [tempAxisX, plotX1, plotX2, clockAxisX]
+	axisLineX := [4]int{tempAxisX, plotX1, plotX2, clockAxisX}
+	axisRight := [4]bool{false, false, true, true}
+	// Label x positions (for rotated vertical text)
+	axisLabelX := [4]int{10, 68, 868, 950}
+
+	for i := 0; i < 4; i++ {
+		ax := axisLineX[i]
+		right := axisRight[i]
+		color := colors[i]
+
+		// Axis line
+		fmt.Fprintf(&b, `<line x1="%d" y1="%d" x2="%d" y2="%d"`+
+			` stroke="%s" stroke-width="1"/>`+"\n",
+			ax, plotY1, ax, plotY2, color)
+
+		// Ticks and tick labels
+		fmt.Fprintf(&b, `<g font-family="sans-serif" font-size="10" fill="%s">`+"\n", color)
+		for _, tick := range axes[i].ticks {
+			y := yv(tick, i)
+			if y < float64(plotY1) || y > float64(plotY2) {
+				continue
+			}
+			dx := -5
+			textX := ax - 8
+			anchor := "end"
+			if right {
+				dx = 5
+				textX = ax + 8
+				anchor = "start"
+			}
+			fmt.Fprintf(&b, `<line x1="%d" y1="%.1f" x2="%d" y2="%.1f"`+
+				` stroke="%s" stroke-width="1"/>`+"\n",
+				ax, y, ax+dx, y, color)
+			fmt.Fprintf(&b, `<text x="%d" y="%.1f" text-anchor="%s" dy="4">%s</text>`+"\n",
+				textX, y, anchor, gpuFormatTick(tick))
+		}
+		b.WriteString("</g>\n")
+
+		// Axis label (rotated)
+		lx := axisLabelX[i]
+		fmt.Fprintf(&b, `<text transform="translate(%d,%d) rotate(-90)"`+
+			` font-family="sans-serif" font-size="12" fill="%s" text-anchor="middle">%s</text>`+"\n",
+			lx, plotY1+PH/2, color, axisLabel[i])
+	}
+
+	// Data lines
+	for i := 0; i < 4; i++ {
+		var pts strings.Builder
+		for j := range rows {
+			x := xv(t[j])
+			y := yv(vals[i][j], i)
+			if j == 0 {
+				fmt.Fprintf(&pts, "%.1f,%.1f", x, y)
+			} else {
+				fmt.Fprintf(&pts, " %.1f,%.1f", x, y)
+			}
+		}
+		fmt.Fprintf(&b, `<polyline points="%s" fill="none" stroke="%s" stroke-width="1.5"/>`+"\n",
+			pts.String(), colors[i])
+	}
+
+	// Legend
+	const legendY = 42
+	for i := 0; i < 4; i++ {
+		lx := plotX1 + i*(PW/4) + 10
+		fmt.Fprintf(&b, `<line x1="%d" y1="%d" x2="%d" y2="%d"`+
+			` stroke="%s" stroke-width="2"/>`+"\n",
+			lx, legendY, lx+20, legendY, colors[i])
+		fmt.Fprintf(&b, `<text x="%d" y="%d" font-family="sans-serif" font-size="12" fill="#333">%s</text>`+"\n",
+			lx+25, legendY+4, seriesLabel[i])
+	}
+
+	b.WriteString("</svg>\n")
+	return b.String()
+}
+
+const (
+	ansiRed    = "\033[31m"
+	ansiBlue   = "\033[34m"
+	ansiGreen  = "\033[32m"
+	ansiYellow = "\033[33m"
+	ansiReset  = "\033[0m"
+)
+
+const (
+	termChartWidth  = 70
+	termChartHeight = 12
+)
+
+// RenderGPUTerminalChart returns ANSI line charts (asciigraph-style) per GPU.
+// Suitable for display in the TUI screenOutput.
+func RenderGPUTerminalChart(rows []GPUMetricRow) string {
+	seen := make(map[int]bool)
+	var order []int
+	gpuMap := make(map[int][]GPUMetricRow)
+	for _, r := range rows {
+		if !seen[r.GPUIndex] {
+			seen[r.GPUIndex] = true
+			order = append(order, r.GPUIndex)
+		}
+		gpuMap[r.GPUIndex] = append(gpuMap[r.GPUIndex], r)
+	}
+
+	type seriesDef struct {
+		caption string
+		color   string
+		fn      func(GPUMetricRow) float64
+	}
+	defs := []seriesDef{
+		{"Temperature (°C)", ansiRed, func(r GPUMetricRow) float64 { return r.TempC }},
+		{"GPU Usage (%)", ansiBlue, func(r GPUMetricRow) float64 { return r.UsagePct }},
+		{"Power (W)", ansiGreen, func(r GPUMetricRow) float64 { return r.PowerW }},
+		{"Clock (MHz)", ansiYellow, func(r GPUMetricRow) float64 { return r.ClockMHz }},
+	}
+
+	var b strings.Builder
+	for _, gpuIdx := range order {
+		gr := gpuMap[gpuIdx]
+		if len(gr) == 0 {
+			continue
+		}
+		tMax := gr[len(gr)-1].ElapsedSec - gr[0].ElapsedSec
+		fmt.Fprintf(&b, "GPU %d — Stress Test Metrics  (%.0f seconds)\n\n", gpuIdx, tMax)
+		for _, d := range defs {
+			b.WriteString(renderLineChart(extractGPUField(gr, d.fn), d.color, d.caption,
+				termChartHeight, termChartWidth))
+			b.WriteRune('\n')
+		}
+	}
+
+	return strings.TrimRight(b.String(), "\n")
+}
+
+// renderLineChart draws a single time-series line chart using box-drawing characters.
+// Produces output in the style of asciigraph: ╭─╮ │ ╰─╯ with a Y axis and caption.
+func renderLineChart(vals []float64, color, caption string, height, width int) string {
+	if len(vals) == 0 {
+		return caption + "\n"
+	}
+
+	mn, mx := gpuMinMax(vals)
+	if mn == mx {
+		mx = mn + 1
+	}
+
+	// Use the smaller of width or len(vals) to avoid stretching sparse data.
+	w := width
+	if len(vals) < w {
+		w = len(vals)
+	}
+	data := gpuDownsample(vals, w)
+
+	// row[i] = display row index: 0 = top = max value, height = bottom = min value.
+	row := make([]int, w)
+	for i, v := range data {
+		r := int(math.Round((mx - v) / (mx - mn) * float64(height)))
+		if r < 0 {
+			r = 0
+		}
+		if r > height {
+			r = height
+		}
+		row[i] = r
+	}
+
+	// Fill the character grid.
+	grid := make([][]rune, height+1)
+	for i := range grid {
+		grid[i] = make([]rune, w)
+		for j := range grid[i] {
+			grid[i][j] = ' '
+		}
+	}
+	for x := 0; x < w; x++ {
+		r := row[x]
+		if x == 0 {
+			grid[r][0] = '─'
+			continue
+		}
+		p := row[x-1]
+		switch {
+		case r == p:
+			grid[r][x] = '─'
+		case r < p: // value went up (row index decreased toward top)
+			grid[r][x] = '╭'
+			grid[p][x] = '╯'
+			for y := r + 1; y < p; y++ {
+				grid[y][x] = '│'
+			}
+		default: // r > p, value went down
+			grid[p][x] = '╮'
+			grid[r][x] = '╰'
+			for y := p + 1; y < r; y++ {
+				grid[y][x] = '│'
+			}
+		}
+	}
+
+	// Y axis tick labels.
+	ticks := gpuNiceTicks(mn, mx, height/2)
+	tickAtRow := make(map[int]string)
+	labelWidth := 4
+	for _, t := range ticks {
+		r := int(math.Round((mx - t) / (mx - mn) * float64(height)))
+		if r < 0 || r > height {
+			continue
+		}
+		s := gpuFormatTick(t)
+		tickAtRow[r] = s
+		if len(s) > labelWidth {
+			labelWidth = len(s)
+		}
+	}
+
+	var b strings.Builder
+	for r := 0; r <= height; r++ {
+		label := tickAtRow[r]
+		fmt.Fprintf(&b, "%*s", labelWidth, label)
+		switch {
+		case label != "":
+			b.WriteRune('┤')
+		case r == height:
+			b.WriteRune('┼')
+		default:
+			b.WriteRune('│')
+		}
+		b.WriteString(color)
+		b.WriteString(string(grid[r]))
+		b.WriteString(ansiReset)
+		b.WriteRune('\n')
+	}
+
+	// Bottom axis.
+	b.WriteString(strings.Repeat(" ", labelWidth))
+	b.WriteRune('└')
+	b.WriteString(strings.Repeat("─", w))
+	b.WriteRune('\n')
+
+	// Caption centered under the chart.
+	if caption != "" {
+		total := labelWidth + 1 + w
+		if pad := (total - len(caption)) / 2; pad > 0 {
+			b.WriteString(strings.Repeat(" ", pad))
+		}
+		b.WriteString(caption)
+		b.WriteRune('\n')
+	}
+
+	return b.String()
+}
+
+func extractGPUField(rows []GPUMetricRow, fn func(GPUMetricRow) float64) []float64 {
+	v := make([]float64, len(rows))
+	for i, r := range rows {
+		v[i] = fn(r)
+	}
+	return v
+}
+
+// gpuDownsample averages vals into w buckets (or nearest-neighbor upsamples if len(vals) < w).
+func gpuDownsample(vals []float64, w int) []float64 {
+	n := len(vals)
+	if n == 0 {
+		return make([]float64, w)
+	}
+	result := make([]float64, w)
+	if n >= w {
+		counts := make([]int, w)
+		for i, v := range vals {
+			bucket := i * w / n
+			if bucket >= w {
+				bucket = w - 1
+			}
+			result[bucket] += v
+			counts[bucket]++
+		}
+		for i := range result {
+			if counts[i] > 0 {
+				result[i] /= float64(counts[i])
+			}
+		}
+	} else {
+		// Nearest-neighbour upsample.
+		for i := range result {
+			src := i * (n - 1) / (w - 1)
+			if src >= n {
+				src = n - 1
+			}
+			result[i] = vals[src]
+		}
+	}
+	return result
+}
+
+func gpuMinMax(vals []float64) (float64, float64) {
+	if len(vals) == 0 {
+		return 0, 1
+	}
+	mn, mx := vals[0], vals[0]
+	for _, v := range vals[1:] {
+		if v < mn {
+			mn = v
+		}
+		if v > mx {
+			mx = v
+		}
+	}
+	return mn, mx
+}
+
+func gpuNiceTicks(mn, mx float64, targetCount int) []float64 {
+	if mn == mx {
+		mn -= 1
+		mx += 1
+	}
+	r := mx - mn
+	step := math.Pow(10, math.Floor(math.Log10(r/float64(targetCount))))
+	for _, f := range []float64{1, 2, 5, 10} {
+		if r/(f*step) <= float64(targetCount)*1.5 {
+			step = f * step
+			break
+		}
+	}
+	lo := math.Floor(mn/step) * step
+	hi := math.Ceil(mx/step) * step
+	var ticks []float64
+	for v := lo; v <= hi+step*0.001; v += step {
+		ticks = append(ticks, math.Round(v*1e9)/1e9)
+	}
+	return ticks
+}
+
+func gpuFormatTick(v float64) string {
+	if v == math.Trunc(v) {
+		return strconv.Itoa(int(v))
+	}
+	return strconv.FormatFloat(v, 'f', 1, 64)
+}

audit/internal/platform/runtime.go

@@ -0,0 +1,214 @@
+package platform
+
+import (
+	"os"
+	"os/exec"
+	"strings"
+	"time"
+
+	"bee/audit/internal/schema"
+)
+
+var runtimeRequiredTools = []string{
+	"dmidecode",
+	"lspci",
+	"lsblk",
+	"smartctl",
+	"nvme",
+	"ipmitool",
+	"dhclient",
+	"mount",
+}
+
+var runtimeTrackedServices = []string{
+	"bee-network",
+	"bee-nvidia",
+	"bee-preflight",
+	"bee-audit",
+	"bee-web",
+	"bee-sshsetup",
+}
+
+func (s *System) CollectRuntimeHealth(exportDir string) (schema.RuntimeHealth, error) {
+	checkedAt := time.Now().UTC().Format(time.RFC3339)
+	health := schema.RuntimeHealth{
+		Status:    "OK",
+		CheckedAt: checkedAt,
+		ExportDir: strings.TrimSpace(exportDir),
+	}
+
+	if health.ExportDir != "" {
+		if err := os.MkdirAll(health.ExportDir, 0755); err != nil {
+			health.Status = "FAILED"
+			health.Issues = append(health.Issues, schema.RuntimeIssue{
+				Code:        "export_dir_unavailable",
+				Severity:    "critical",
+				Description: err.Error(),
+			})
+		}
+	}
+
+	interfaces, err := s.ListInterfaces()
+	if err == nil {
+		health.Interfaces = make([]schema.RuntimeInterface, 0, len(interfaces))
+		hasIPv4 := false
+		missingIPv4 := false
+		for _, iface := range interfaces {
+			outcome := "no_offer"
+			if len(iface.IPv4) > 0 {
+				outcome = "lease_acquired"
+				hasIPv4 = true
+			} else if strings.EqualFold(iface.State, "DOWN") {
+				outcome = "link_down"
+			} else {
+				missingIPv4 = true
+			}
+			health.Interfaces = append(health.Interfaces, schema.RuntimeInterface{
+				Name:    iface.Name,
+				State:   iface.State,
+				IPv4:    iface.IPv4,
+				Outcome: outcome,
+			})
+		}
+		switch {
+		case hasIPv4 && !missingIPv4:
+			health.NetworkStatus = "OK"
+		case hasIPv4:
+			health.NetworkStatus = "PARTIAL"
+			health.Issues = append(health.Issues, schema.RuntimeIssue{
+				Code:        "dhcp_partial",
+				Severity:    "warning",
+				Description: "At least one interface did not obtain IPv4 connectivity.",
+			})
+		default:
+			health.NetworkStatus = "FAILED"
+			health.Issues = append(health.Issues, schema.RuntimeIssue{
+				Code:        "dhcp_failed",
+				Severity:    "warning",
+				Description: "No physical interface obtained IPv4 connectivity.",
+			})
+		}
+	}
+
+	vendor := s.DetectGPUVendor()
+	for _, tool := range s.runtimeToolStatuses(vendor) {
+		health.Tools = append(health.Tools, schema.RuntimeToolStatus{
+			Name: tool.Name,
+			Path: tool.Path,
+			OK:   tool.OK,
+		})
+		if !tool.OK {
+			health.Issues = append(health.Issues, schema.RuntimeIssue{
+				Code:        "tool_missing",
+				Severity:    "warning",
+				Description: "Required tool missing: " + tool.Name,
+			})
+		}
+	}
+
+	for _, name := range runtimeTrackedServices {
+		health.Services = append(health.Services, schema.RuntimeServiceStatus{
+			Name:   name,
+			Status: s.ServiceState(name),
+		})
+	}
+
+	s.collectGPURuntimeHealth(vendor, &health)
+
+	if health.Status != "FAILED" && len(health.Issues) > 0 {
+		health.Status = "PARTIAL"
+	}
+	return health, nil
+}
+
+func commandText(name string, args ...string) string {
+	raw, err := exec.Command(name, args...).CombinedOutput()
+	if err != nil && len(raw) == 0 {
+		return ""
+	}
+	return string(raw)
+}
+
+func (s *System) runtimeToolStatuses(vendor string) []ToolStatus {
+	tools := s.CheckTools(runtimeRequiredTools)
+	switch vendor {
+	case "nvidia":
+		tools = append(tools, s.CheckTools([]string{
+			"nvidia-smi",
+			"nvidia-bug-report.sh",
+			"bee-gpu-stress",
+		})...)
+	case "amd":
+		tool := ToolStatus{Name: "rocm-smi"}
+		if cmd, err := resolveROCmSMICommand(); err == nil && len(cmd) > 0 {
+			tool.Path = cmd[0]
+			if len(cmd) > 1 && strings.HasSuffix(cmd[1], "rocm_smi.py") {
+				tool.Path = cmd[1]
+			}
+			tool.OK = true
+		}
+		tools = append(tools, tool)
+	}
+	return tools
+}
+
+func (s *System) collectGPURuntimeHealth(vendor string, health *schema.RuntimeHealth) {
+	lsmodText := commandText("lsmod")
+
+	switch vendor {
+	case "nvidia":
+		health.DriverReady = strings.Contains(lsmodText, "nvidia ")
+		if !health.DriverReady {
+			health.Issues = append(health.Issues, schema.RuntimeIssue{
+				Code:        "nvidia_kernel_module_missing",
+				Severity:    "warning",
+				Description: "NVIDIA kernel module is not loaded.",
+			})
+		}
+		if health.DriverReady && !strings.Contains(lsmodText, "nvidia_modeset") {
+			health.Issues = append(health.Issues, schema.RuntimeIssue{
+				Code:        "nvidia_modeset_failed",
+				Severity:    "warning",
+				Description: "nvidia-modeset is not loaded; display/CUDA stack may be partial.",
+			})
+		}
+		if out, err := exec.Command("nvidia-smi", "-L").CombinedOutput(); err == nil && strings.TrimSpace(string(out)) != "" {
+			health.DriverReady = true
+		}
+
+		if lookErr := exec.Command("sh", "-c", "command -v bee-gpu-stress >/dev/null 2>&1").Run(); lookErr == nil {
+			out, err := exec.Command("bee-gpu-stress", "--seconds", "1", "--size-mb", "1").CombinedOutput()
+			if err == nil {
+				health.CUDAReady = true
+			} else if strings.Contains(strings.ToLower(string(out)), "cuda_error_system_not_ready") {
+				health.Issues = append(health.Issues, schema.RuntimeIssue{
+					Code:        "cuda_runtime_not_ready",
+					Severity:    "warning",
+					Description: "CUDA runtime is not ready for GPU SAT.",
+				})
+			}
+		}
+	case "amd":
+		health.DriverReady = strings.Contains(lsmodText, "amdgpu ") || strings.Contains(lsmodText, "amdkfd")
+		if !health.DriverReady {
+			health.Issues = append(health.Issues, schema.RuntimeIssue{
+				Code:        "amdgpu_kernel_module_missing",
+				Severity:    "warning",
+				Description: "AMD GPU driver is not loaded.",
+			})
+		}
+
+		out, err := runROCmSMI("--showproductname", "--csv")
+		if err == nil && strings.TrimSpace(string(out)) != "" {
+			health.CUDAReady = true
+			health.DriverReady = true
+			return
+		}
+
+		health.Issues = append(health.Issues, schema.RuntimeIssue{
+			Code:        "rocm_smi_unavailable",
+			Severity:    "warning",
+			Description: "ROCm SMI is not available for AMD GPU SAT.",
+		})
+	}
+}

audit/internal/platform/sat.go

@@ -3,6 +3,8 @@ package platform
 import (
 	"archive/tar"
 	"compress/gzip"
+	"context"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -14,10 +16,121 @@ import (
 	"time"
 )
 
+var (
+	satExecCommand = exec.Command
+	satLookPath    = exec.LookPath
+	satGlob        = filepath.Glob
+	satStat        = os.Stat
+
+	rocmSMIExecutableGlobs = []string{
+		"/opt/rocm/bin/rocm-smi",
+		"/opt/rocm-*/bin/rocm-smi",
+	}
+	rocmSMIScriptGlobs = []string{
+		"/opt/rocm/libexec/rocm_smi/rocm_smi.py",
+		"/opt/rocm-*/libexec/rocm_smi/rocm_smi.py",
+	}
+)
+
+// NvidiaGPU holds basic GPU info from nvidia-smi.
+type NvidiaGPU struct {
+	Index    int
+	Name     string
+	MemoryMB int
+}
+
+// AMDGPUInfo holds basic info about an AMD GPU from rocm-smi.
+type AMDGPUInfo struct {
+	Index int
+	Name  string
+}
+
+// DetectGPUVendor returns "nvidia" if /dev/nvidia0 exists, "amd" if /dev/kfd exists, or "" otherwise.
+func (s *System) DetectGPUVendor() string {
+	if _, err := os.Stat("/dev/nvidia0"); err == nil {
+		return "nvidia"
+	}
+	if _, err := os.Stat("/dev/kfd"); err == nil {
+		return "amd"
+	}
+	return ""
+}
+
+// ListAMDGPUs returns AMD GPUs visible to rocm-smi.
+func (s *System) ListAMDGPUs() ([]AMDGPUInfo, error) {
+	out, err := runROCmSMI("--showproductname", "--csv")
+	if err != nil {
+		return nil, fmt.Errorf("rocm-smi: %w", err)
+	}
+	var gpus []AMDGPUInfo
+	for _, line := range strings.Split(strings.TrimSpace(string(out)), "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" || strings.HasPrefix(strings.ToLower(line), "device") {
+			continue
+		}
+		parts := strings.SplitN(line, ",", 2)
+		name := ""
+		if len(parts) >= 2 {
+			name = strings.TrimSpace(parts[1])
+		}
+		idx := len(gpus)
+		gpus = append(gpus, AMDGPUInfo{Index: idx, Name: name})
+	}
+	return gpus, nil
+}
+
+// RunAMDAcceptancePack runs an AMD GPU diagnostic pack using rocm-smi.
+func (s *System) RunAMDAcceptancePack(baseDir string) (string, error) {
+	return runAcceptancePack(baseDir, "gpu-amd", []satJob{
+		{name: "01-rocm-smi.log", cmd: []string{"rocm-smi"}},
+		{name: "02-rocm-smi-showallinfo.log", cmd: []string{"rocm-smi", "--showallinfo"}},
+		{name: "03-dmidecode-baseboard.log", cmd: []string{"dmidecode", "-t", "baseboard"}},
+		{name: "04-dmidecode-system.log", cmd: []string{"dmidecode", "-t", "system"}},
+	})
+}
+
+// ListNvidiaGPUs returns GPUs visible to nvidia-smi.
+func (s *System) ListNvidiaGPUs() ([]NvidiaGPU, error) {
+	out, err := exec.Command("nvidia-smi",
+		"--query-gpu=index,name,memory.total",
+		"--format=csv,noheader,nounits").Output()
+	if err != nil {
+		return nil, fmt.Errorf("nvidia-smi: %w", err)
+	}
+	var gpus []NvidiaGPU
+	for _, line := range strings.Split(strings.TrimSpace(string(out)), "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" {
+			continue
+		}
+		parts := strings.SplitN(line, ", ", 3)
+		if len(parts) != 3 {
+			continue
+		}
+		idx, err := strconv.Atoi(strings.TrimSpace(parts[0]))
+		if err != nil {
+			continue
+		}
+		memMB, _ := strconv.Atoi(strings.TrimSpace(parts[2]))
+		gpus = append(gpus, NvidiaGPU{
+			Index:    idx,
+			Name:     strings.TrimSpace(parts[1]),
+			MemoryMB: memMB,
+		})
+	}
+	return gpus, nil
+}
+
 func (s *System) RunNvidiaAcceptancePack(baseDir string) (string, error) {
 	return runAcceptancePack(baseDir, "gpu-nvidia", nvidiaSATJobs())
 }
 
+// RunNvidiaAcceptancePackWithOptions runs the NVIDIA SAT with explicit duration,
+// GPU memory size, and GPU index selection. ctx cancellation kills the running job.
+func (s *System) RunNvidiaAcceptancePackWithOptions(ctx context.Context, baseDir string, durationSec int, sizeMB int, gpuIndices []int) (string, error) {
+	return runAcceptancePackCtx(ctx, baseDir, "gpu-nvidia", nvidiaSATJobsWithOptions(durationSec, sizeMB, gpuIndices))
+}
+
 func (s *System) RunMemoryAcceptancePack(baseDir string) (string, error) {
 	sizeMB := envInt("BEE_MEMTESTER_SIZE_MB", 128)
 	passes := envInt("BEE_MEMTESTER_PASSES", 1)
@@ -28,6 +141,18 @@ func (s *System) RunMemoryAcceptancePack(baseDir string) (string, error) {
 	})
 }
 
+func (s *System) RunCPUAcceptancePack(baseDir string, durationSec int) (string, error) {
+	if durationSec <= 0 {
+		durationSec = 60
+	}
+	return runAcceptancePack(baseDir, "cpu", []satJob{
+		{name: "01-lscpu.log", cmd: []string{"lscpu"}},
+		{name: "02-sensors-before.log", cmd: []string{"sensors"}},
+		{name: "03-stress-ng.log", cmd: []string{"stress-ng", "--cpu", "0", "--cpu-method", "all", "--timeout", fmt.Sprintf("%d", durationSec)}},
+		{name: "04-sensors-after.log", cmd: []string{"sensors"}},
+	})
+}
+
 func (s *System) RunStorageAcceptancePack(baseDir string) (string, error) {
 	if baseDir == "" {
 		baseDir = "/var/log/bee-sat"
@@ -37,6 +162,7 @@ func (s *System) RunStorageAcceptancePack(baseDir string) (string, error) {
 	if err := os.MkdirAll(runDir, 0755); err != nil {
 		return "", err
 	}
+	verboseLog := filepath.Join(runDir, "verbose.log")
 
 	devices, err := listStorageDevices()
 	if err != nil {
@@ -59,7 +185,7 @@ func (s *System) RunStorageAcceptancePack(baseDir string) (string, error) {
 		commands := storageSATCommands(devPath)
 		for cmdIndex, job := range commands {
 			name := fmt.Sprintf("%s-%02d-%s.log", prefix, cmdIndex+1, job.name)
-			out, err := exec.Command(job.cmd[0], job.cmd[1:]...).CombinedOutput()
+			out, err := runSATCommand(verboseLog, job.name, job.cmd)
 			if writeErr := os.WriteFile(filepath.Join(runDir, name), out, 0644); writeErr != nil {
 				return "", writeErr
 			}
@@ -83,8 +209,11 @@ func (s *System) RunStorageAcceptancePack(baseDir string) (string, error) {
 }
 
 type satJob struct {
-	name string
-	cmd  []string
+	name       string
+	cmd        []string
+	env        []string // extra env vars (appended to os.Environ)
+	collectGPU bool     // collect GPU metrics via nvidia-smi while this job runs
+	gpuIndices []int    // GPU indices to collect metrics for (empty = all)
 }
 
 type satStats struct {
@@ -100,7 +229,7 @@ func nvidiaSATJobs() []satJob {
 		{name: "01-nvidia-smi-q.log", cmd: []string{"nvidia-smi", "-q"}},
 		{name: "02-dmidecode-baseboard.log", cmd: []string{"dmidecode", "-t", "baseboard"}},
 		{name: "03-dmidecode-system.log", cmd: []string{"dmidecode", "-t", "system"}},
-		{name: "04-nvidia-bug-report.log", cmd: []string{"nvidia-bug-report.sh", "--output", "{{run_dir}}/nvidia-bug-report.log"}},
+		{name: "04-nvidia-bug-report.log", cmd: []string{"nvidia-bug-report.sh", "--output-file", "{{run_dir}}/nvidia-bug-report.log"}},
 		{name: "05-bee-gpu-stress.log", cmd: []string{"bee-gpu-stress", "--seconds", fmt.Sprintf("%d", seconds), "--size-mb", fmt.Sprintf("%d", sizeMB)}},
 	}
 }
@@ -114,6 +243,7 @@ func runAcceptancePack(baseDir, prefix string, jobs []satJob) (string, error) {
 	if err := os.MkdirAll(runDir, 0755); err != nil {
 		return "", err
 	}
+	verboseLog := filepath.Join(runDir, "verbose.log")
 
 	var summary strings.Builder
 	stats := satStats{}
@@ -123,7 +253,7 @@ func runAcceptancePack(baseDir, prefix string, jobs []satJob) (string, error) {
 		for _, arg := range job.cmd {
 			cmd = append(cmd, strings.ReplaceAll(arg, "{{run_dir}}", runDir))
 		}
-		out, err := exec.Command(cmd[0], cmd[1:]...).CombinedOutput()
+		out, err := runSATCommand(verboseLog, job.name, cmd)
 		if writeErr := os.WriteFile(filepath.Join(runDir, job.name), out, 0644); writeErr != nil {
 			return "", writeErr
 		}
@@ -145,20 +275,125 @@ func runAcceptancePack(baseDir, prefix string, jobs []satJob) (string, error) {
 	return archive, nil
 }
 
+func nvidiaSATJobsWithOptions(durationSec, sizeMB int, gpuIndices []int) []satJob {
+	var env []string
+	if len(gpuIndices) > 0 {
+		ids := make([]string, len(gpuIndices))
+		for i, idx := range gpuIndices {
+			ids[i] = strconv.Itoa(idx)
+		}
+		env = []string{"CUDA_VISIBLE_DEVICES=" + strings.Join(ids, ",")}
+	}
+	return []satJob{
+		{name: "01-nvidia-smi-q.log", cmd: []string{"nvidia-smi", "-q"}},
+		{name: "02-dmidecode-baseboard.log", cmd: []string{"dmidecode", "-t", "baseboard"}},
+		{name: "03-dmidecode-system.log", cmd: []string{"dmidecode", "-t", "system"}},
+		{name: "04-nvidia-bug-report.log", cmd: []string{"nvidia-bug-report.sh", "--output-file", "{{run_dir}}/nvidia-bug-report.log"}},
+		{
+			name:       "05-bee-gpu-stress.log",
+			cmd:        []string{"bee-gpu-stress", "--seconds", strconv.Itoa(durationSec), "--size-mb", strconv.Itoa(sizeMB)},
+			env:        env,
+			collectGPU: true,
+			gpuIndices: gpuIndices,
+		},
+	}
+}
+
+func runAcceptancePackCtx(ctx context.Context, baseDir, prefix string, jobs []satJob) (string, error) {
+	if baseDir == "" {
+		baseDir = "/var/log/bee-sat"
+	}
+	ts := time.Now().UTC().Format("20060102-150405")
+	runDir := filepath.Join(baseDir, prefix+"-"+ts)
+	if err := os.MkdirAll(runDir, 0755); err != nil {
+		return "", err
+	}
+	verboseLog := filepath.Join(runDir, "verbose.log")
+
+	var summary strings.Builder
+	stats := satStats{}
+	fmt.Fprintf(&summary, "run_at_utc=%s\n", time.Now().UTC().Format(time.RFC3339))
+	for _, job := range jobs {
+		if ctx.Err() != nil {
+			break
+		}
+		cmd := make([]string, 0, len(job.cmd))
+		for _, arg := range job.cmd {
+			cmd = append(cmd, strings.ReplaceAll(arg, "{{run_dir}}", runDir))
+		}
+
+		var out []byte
+		var err error
+
+		if job.collectGPU {
+			out, err = runSATCommandWithMetrics(ctx, verboseLog, job.name, cmd, job.env, job.gpuIndices, runDir)
+		} else {
+			out, err = runSATCommandCtx(ctx, verboseLog, job.name, cmd, job.env)
+		}
+
+		if writeErr := os.WriteFile(filepath.Join(runDir, job.name), out, 0644); writeErr != nil {
+			return "", writeErr
+		}
+		status, rc := classifySATResult(job.name, out, err)
+		stats.Add(status)
+		key := strings.TrimSuffix(strings.TrimPrefix(job.name, "0"), ".log")
+		fmt.Fprintf(&summary, "%s_rc=%d\n", key, rc)
+		fmt.Fprintf(&summary, "%s_status=%s\n", key, status)
+	}
+	writeSATStats(&summary, stats)
+	if err := os.WriteFile(filepath.Join(runDir, "summary.txt"), []byte(summary.String()), 0644); err != nil {
+		return "", err
+	}
+
+	archive := filepath.Join(baseDir, prefix+"-"+ts+".tar.gz")
+	if err := createTarGz(archive, runDir); err != nil {
+		return "", err
+	}
+	return archive, nil
+}
+
+func runSATCommandCtx(ctx context.Context, verboseLog, name string, cmd []string, env []string) ([]byte, error) {
+	start := time.Now().UTC()
+	resolvedCmd, err := resolveSATCommand(cmd)
+	appendSATVerboseLog(verboseLog,
+		fmt.Sprintf("[%s] start %s", start.Format(time.RFC3339), name),
+		"cmd: "+strings.Join(resolvedCmd, " "),
+	)
+	if err != nil {
+		appendSATVerboseLog(verboseLog,
+			fmt.Sprintf("[%s] finish %s", time.Now().UTC().Format(time.RFC3339), name),
+			"rc: 1",
+			fmt.Sprintf("duration_ms: %d", time.Since(start).Milliseconds()),
+			"",
+		)
+		return []byte(err.Error() + "\n"), err
+	}
+
+	c := exec.CommandContext(ctx, resolvedCmd[0], resolvedCmd[1:]...)
+	if len(env) > 0 {
+		c.Env = append(os.Environ(), env...)
+	}
+	out, err := c.CombinedOutput()
+
+	rc := 0
+	if err != nil {
+		rc = 1
+	}
+	appendSATVerboseLog(verboseLog,
+		fmt.Sprintf("[%s] finish %s", time.Now().UTC().Format(time.RFC3339), name),
+		fmt.Sprintf("rc: %d", rc),
+		fmt.Sprintf("duration_ms: %d", time.Since(start).Milliseconds()),
+		"",
+	)
+	return out, err
+}
+
 func listStorageDevices() ([]string, error) {
-	out, err := exec.Command("lsblk", "-dn", "-o", "NAME,TYPE").Output()
+	out, err := satExecCommand("lsblk", "-dn", "-o", "NAME,TYPE,TRAN").Output()
 	if err != nil {
 		return nil, err
 	}
-	var devices []string
-	for _, line := range strings.Split(strings.TrimSpace(string(out)), "\n") {
-		fields := strings.Fields(strings.TrimSpace(line))
-		if len(fields) != 2 || fields[1] != "disk" {
-			continue
-		}
-		devices = append(devices, "/dev/"+fields[0])
-	}
-	return devices, nil
+	return parseStorageDevices(string(out)), nil
 }
 
 func storageSATCommands(devPath string) []satJob {
@@ -166,7 +401,7 @@ func storageSATCommands(devPath string) []satJob {
 		return []satJob{
 			{name: "nvme-id-ctrl", cmd: []string{"nvme", "id-ctrl", devPath, "-o", "json"}},
 			{name: "nvme-smart-log", cmd: []string{"nvme", "smart-log", devPath, "-o", "json"}},
-			{name: "nvme-device-self-test", cmd: []string{"nvme", "device-self-test", devPath, "--start", "1"}},
+			{name: "nvme-device-self-test", cmd: []string{"nvme", "device-self-test", devPath, "-s", "1", "--wait"}},
 		}
 	}
 	return []satJob{
@@ -219,6 +454,7 @@ func classifySATResult(name string, out []byte, err error) (string, int) {
 		strings.Contains(text, "unknown command") ||
 		strings.Contains(text, "not implemented") ||
 		strings.Contains(text, "not available") ||
+		strings.Contains(text, "cuda_error_system_not_ready") ||
 		strings.Contains(text, "no such device") ||
 		(strings.Contains(name, "self-test") && strings.Contains(text, "aborted")) {
 		return "UNSUPPORTED", rc
@@ -226,6 +462,182 @@ func classifySATResult(name string, out []byte, err error) (string, int) {
 	return "FAILED", rc
 }
 
+func runSATCommand(verboseLog, name string, cmd []string) ([]byte, error) {
+	start := time.Now().UTC()
+	resolvedCmd, err := resolveSATCommand(cmd)
+	appendSATVerboseLog(verboseLog,
+		fmt.Sprintf("[%s] start %s", start.Format(time.RFC3339), name),
+		"cmd: "+strings.Join(resolvedCmd, " "),
+	)
+	if err != nil {
+		appendSATVerboseLog(verboseLog,
+			fmt.Sprintf("[%s] finish %s", time.Now().UTC().Format(time.RFC3339), name),
+			"rc: 1",
+			fmt.Sprintf("duration_ms: %d", time.Since(start).Milliseconds()),
+			"",
+		)
+		return []byte(err.Error() + "\n"), err
+	}
+
+	out, err := satExecCommand(resolvedCmd[0], resolvedCmd[1:]...).CombinedOutput()
+
+	rc := 0
+	if err != nil {
+		rc = 1
+	}
+	appendSATVerboseLog(verboseLog,
+		fmt.Sprintf("[%s] finish %s", time.Now().UTC().Format(time.RFC3339), name),
+		fmt.Sprintf("rc: %d", rc),
+		fmt.Sprintf("duration_ms: %d", time.Since(start).Milliseconds()),
+		"",
+	)
+	return out, err
+}
+
+func runROCmSMI(args ...string) ([]byte, error) {
+	cmd, err := resolveROCmSMICommand(args...)
+	if err != nil {
+		return nil, err
+	}
+	return satExecCommand(cmd[0], cmd[1:]...).CombinedOutput()
+}
+
+func resolveSATCommand(cmd []string) ([]string, error) {
+	if len(cmd) == 0 {
+		return nil, errors.New("empty SAT command")
+	}
+	if cmd[0] != "rocm-smi" {
+		return cmd, nil
+	}
+	return resolveROCmSMICommand(cmd[1:]...)
+}
+
+func resolveROCmSMICommand(args ...string) ([]string, error) {
+	if path, err := satLookPath("rocm-smi"); err == nil {
+		return append([]string{path}, args...), nil
+	}
+
+	for _, path := range rocmSMIExecutableCandidates() {
+		return append([]string{path}, args...), nil
+	}
+
+	pythonPath, pyErr := satLookPath("python3")
+	if pyErr == nil {
+		for _, script := range rocmSMIScriptCandidates() {
+			cmd := []string{pythonPath, script}
+			cmd = append(cmd, args...)
+			return cmd, nil
+		}
+	}
+
+	return nil, errors.New("rocm-smi not found in PATH or under /opt/rocm")
+}
+
+func rocmSMIExecutableCandidates() []string {
+	return expandExistingPaths(rocmSMIExecutableGlobs)
+}
+
+func rocmSMIScriptCandidates() []string {
+	return expandExistingPaths(rocmSMIScriptGlobs)
+}
+
+func expandExistingPaths(patterns []string) []string {
+	seen := make(map[string]struct{})
+	var paths []string
+	for _, pattern := range patterns {
+		matches, err := satGlob(pattern)
+		if err != nil {
+			continue
+		}
+		sort.Strings(matches)
+		for _, match := range matches {
+			if _, err := satStat(match); err != nil {
+				continue
+			}
+			if _, ok := seen[match]; ok {
+				continue
+			}
+			seen[match] = struct{}{}
+			paths = append(paths, match)
+		}
+	}
+	return paths
+}
+
+func parseStorageDevices(raw string) []string {
+	var devices []string
+	for _, line := range strings.Split(strings.TrimSpace(raw), "\n") {
+		fields := strings.Fields(strings.TrimSpace(line))
+		if len(fields) < 2 || fields[1] != "disk" {
+			continue
+		}
+		if len(fields) >= 3 && strings.EqualFold(fields[2], "usb") {
+			continue
+		}
+		devices = append(devices, "/dev/"+fields[0])
+	}
+	return devices
+}
+
+// runSATCommandWithMetrics runs a command while collecting GPU metrics in the background.
+// On completion it writes gpu-metrics.csv and gpu-metrics.html into runDir.
+func runSATCommandWithMetrics(ctx context.Context, verboseLog, name string, cmd []string, env []string, gpuIndices []int, runDir string) ([]byte, error) {
+	stopCh := make(chan struct{})
+	doneCh := make(chan struct{})
+	var metricRows []GPUMetricRow
+	start := time.Now()
+
+	go func() {
+		defer close(doneCh)
+		ticker := time.NewTicker(time.Second)
+		defer ticker.Stop()
+		for {
+			select {
+			case <-stopCh:
+				return
+			case <-ticker.C:
+				samples, err := sampleGPUMetrics(gpuIndices)
+				if err != nil {
+					continue
+				}
+				elapsed := time.Since(start).Seconds()
+				for i := range samples {
+					samples[i].ElapsedSec = elapsed
+				}
+				metricRows = append(metricRows, samples...)
+			}
+		}
+	}()
+
+	out, err := runSATCommandCtx(ctx, verboseLog, name, cmd, env)
+
+	close(stopCh)
+	<-doneCh
+
+	if len(metricRows) > 0 {
+		_ = WriteGPUMetricsCSV(filepath.Join(runDir, "gpu-metrics.csv"), metricRows)
+		_ = WriteGPUMetricsHTML(filepath.Join(runDir, "gpu-metrics.html"), metricRows)
+		chart := RenderGPUTerminalChart(metricRows)
+		_ = os.WriteFile(filepath.Join(runDir, "gpu-metrics-term.txt"), []byte(chart), 0644)
+	}
+
+	return out, err
+}
+
+func appendSATVerboseLog(path string, lines ...string) {
+	if path == "" {
+		return
+	}
+	f, err := os.OpenFile(path, os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0644)
+	if err != nil {
+		return
+	}
+	defer f.Close()
+	for _, line := range lines {
+		_, _ = io.WriteString(f, line+"\n")
+	}
+}
+
 func envInt(name string, fallback int) int {
 	raw := strings.TrimSpace(os.Getenv(name))
 	if raw == "" {

audit/internal/platform/sat_test.go

@@ -3,6 +3,8 @@ package platform
 import (
 	"errors"
 	"os"
+	"os/exec"
+	"path/filepath"
 	"testing"
 )
 
@@ -31,6 +33,9 @@ func TestRunNvidiaAcceptancePackIncludesGPUStress(t *testing.T) {
 	if got := jobs[4].cmd[0]; got != "bee-gpu-stress" {
 		t.Fatalf("gpu stress command=%q want bee-gpu-stress", got)
 	}
+	if got := jobs[3].cmd[1]; got != "--output-file" {
+		t.Fatalf("bug report flag=%q want --output-file", got)
+	}
 }
 
 func TestNvidiaSATJobsUseEnvOverrides(t *testing.T) {
@@ -76,6 +81,7 @@ func TestClassifySATResult(t *testing.T) {
 		{name: "ok", job: "memtester", out: "done", err: nil, status: "OK"},
 		{name: "unsupported", job: "smartctl-self-test-short", out: "Self-test not supported", err: errors.New("rc 1"), status: "UNSUPPORTED"},
 		{name: "failed", job: "bee-gpu-stress", out: "cuda error", err: errors.New("rc 1"), status: "FAILED"},
+		{name: "cuda not ready", job: "bee-gpu-stress", out: "cuInit failed: CUDA_ERROR_SYSTEM_NOT_READY", err: errors.New("rc 1"), status: "UNSUPPORTED"},
 	}
 
 	for _, tt := range tests {
@@ -87,3 +93,90 @@ func TestClassifySATResult(t *testing.T) {
 		})
 	}
 }
+
+func TestParseStorageDevicesSkipsUSBDisks(t *testing.T) {
+	t.Parallel()
+
+	raw := "nvme0n1 disk nvme\nsda disk usb\nloop0 loop\nsdb disk sata\n"
+	got := parseStorageDevices(raw)
+	want := []string{"/dev/nvme0n1", "/dev/sdb"}
+	if len(got) != len(want) {
+		t.Fatalf("len(devices)=%d want %d (%v)", len(got), len(want), got)
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Fatalf("devices[%d]=%q want %q", i, got[i], want[i])
+		}
+	}
+}
+
+func TestResolveROCmSMICommandFromPATH(t *testing.T) {
+	t.Setenv("PATH", t.TempDir())
+
+	toolPath := filepath.Join(os.Getenv("PATH"), "rocm-smi")
+	if err := os.WriteFile(toolPath, []byte("#!/bin/sh\nexit 0\n"), 0755); err != nil {
+		t.Fatalf("write rocm-smi: %v", err)
+	}
+
+	cmd, err := resolveROCmSMICommand("--showproductname")
+	if err != nil {
+		t.Fatalf("resolveROCmSMICommand error: %v", err)
+	}
+	if len(cmd) != 2 {
+		t.Fatalf("cmd len=%d want 2 (%v)", len(cmd), cmd)
+	}
+	if cmd[0] != toolPath {
+		t.Fatalf("cmd[0]=%q want %q", cmd[0], toolPath)
+	}
+}
+
+func TestResolveROCmSMICommandFallsBackToROCmTree(t *testing.T) {
+	tmp := t.TempDir()
+	execPath := filepath.Join(tmp, "opt", "rocm", "bin", "rocm-smi")
+	if err := os.MkdirAll(filepath.Dir(execPath), 0755); err != nil {
+		t.Fatalf("mkdir: %v", err)
+	}
+	if err := os.WriteFile(execPath, []byte("#!/bin/sh\nexit 0\n"), 0755); err != nil {
+		t.Fatalf("write rocm-smi: %v", err)
+	}
+
+	oldGlob := rocmSMIExecutableGlobs
+	oldScriptGlobs := rocmSMIScriptGlobs
+	rocmSMIExecutableGlobs = []string{execPath}
+	rocmSMIScriptGlobs = nil
+	t.Cleanup(func() {
+		rocmSMIExecutableGlobs = oldGlob
+		rocmSMIScriptGlobs = oldScriptGlobs
+	})
+
+	t.Setenv("PATH", "")
+
+	cmd, err := resolveROCmSMICommand("--showallinfo")
+	if err != nil {
+		t.Fatalf("resolveROCmSMICommand error: %v", err)
+	}
+	if len(cmd) != 2 {
+		t.Fatalf("cmd len=%d want 2 (%v)", len(cmd), cmd)
+	}
+	if cmd[0] != execPath {
+		t.Fatalf("cmd[0]=%q want %q", cmd[0], execPath)
+	}
+}
+
+func TestRunROCmSMIReportsMissingCommand(t *testing.T) {
+	oldLookPath := satLookPath
+	oldExecGlobs := rocmSMIExecutableGlobs
+	oldScriptGlobs := rocmSMIScriptGlobs
+	satLookPath = func(string) (string, error) { return "", exec.ErrNotFound }
+	rocmSMIExecutableGlobs = nil
+	rocmSMIScriptGlobs = nil
+	t.Cleanup(func() {
+		satLookPath = oldLookPath
+		rocmSMIExecutableGlobs = oldExecGlobs
+		rocmSMIScriptGlobs = oldScriptGlobs
+	})
+
+	if _, err := runROCmSMI("--showproductname"); err == nil {
+		t.Fatal("expected missing rocm-smi error")
+	}
+}

audit/internal/platform/techdump.go

@@ -0,0 +1,150 @@
+package platform
+
+import (
+	"encoding/json"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"sort"
+	"strings"
+)
+
+var techDumpFixedCommands = []struct {
+	Name string
+	Args []string
+	File string
+}{
+	{Name: "dmidecode", Args: []string{"-t", "0"}, File: "dmidecode-type0.txt"},
+	{Name: "dmidecode", Args: []string{"-t", "1"}, File: "dmidecode-type1.txt"},
+	{Name: "dmidecode", Args: []string{"-t", "2"}, File: "dmidecode-type2.txt"},
+	{Name: "dmidecode", Args: []string{"-t", "4"}, File: "dmidecode-type4.txt"},
+	{Name: "dmidecode", Args: []string{"-t", "17"}, File: "dmidecode-type17.txt"},
+	{Name: "lspci", Args: []string{"-vmm", "-D"}, File: "lspci-vmm.txt"},
+	{Name: "lsblk", Args: []string{"-J", "-d", "-o", "NAME,TYPE,SIZE,SERIAL,MODEL,TRAN,HCTL"}, File: "lsblk.json"},
+	{Name: "sensors", Args: []string{"-j"}, File: "sensors.json"},
+	{Name: "ipmitool", Args: []string{"fru", "print"}, File: "ipmitool-fru.txt"},
+	{Name: "ipmitool", Args: []string{"sdr"}, File: "ipmitool-sdr.txt"},
+	{Name: "nvme", Args: []string{"list", "-o", "json"}, File: "nvme-list.json"},
+}
+
+var techDumpNvidiaCommands = []struct {
+	Name string
+	Args []string
+	File string
+}{
+	{Name: "nvidia-smi", Args: []string{"-q"}, File: "nvidia-smi-q.txt"},
+	{Name: "nvidia-smi", Args: []string{"--query-gpu=index,pci.bus_id,serial,vbios_version,temperature.gpu,power.draw,ecc.errors.uncorrected.aggregate.total,ecc.errors.corrected.aggregate.total,clocks_throttle_reasons.hw_slowdown", "--format=csv,noheader,nounits"}, File: "nvidia-smi-query.csv"},
+}
+
+type lsblkDumpRoot struct {
+	Blockdevices []struct {
+		Name string `json:"name"`
+		Type string `json:"type"`
+		Tran string `json:"tran"`
+	} `json:"blockdevices"`
+}
+
+type nvmeDumpRoot struct {
+	Devices []struct {
+		DevicePath string `json:"DevicePath"`
+	} `json:"Devices"`
+}
+
+func (s *System) CaptureTechnicalDump(baseDir string) error {
+	if err := os.MkdirAll(baseDir, 0755); err != nil {
+		return err
+	}
+
+	for _, cmd := range techDumpFixedCommands {
+		writeCommandDump(filepath.Join(baseDir, cmd.File), cmd.Name, cmd.Args...)
+	}
+	switch s.DetectGPUVendor() {
+	case "nvidia":
+		for _, cmd := range techDumpNvidiaCommands {
+			writeCommandDump(filepath.Join(baseDir, cmd.File), cmd.Name, cmd.Args...)
+		}
+	case "amd":
+		writeROCmSMIDump(filepath.Join(baseDir, "rocm-smi.txt"))
+		writeROCmSMIDump(filepath.Join(baseDir, "rocm-smi-showallinfo.txt"), "--showallinfo")
+	}
+
+	for _, dev := range lsblkDumpDevices(filepath.Join(baseDir, "lsblk.json")) {
+		writeCommandDump(filepath.Join(baseDir, "smartctl-"+sanitizeDumpName(dev)+".json"), "smartctl", "-j", "-a", "/dev/"+dev)
+	}
+	for _, dev := range nvmeDumpDevices(filepath.Join(baseDir, "nvme-list.json")) {
+		writeCommandDump(filepath.Join(baseDir, "nvme-id-ctrl-"+sanitizeDumpName(dev)+".json"), "nvme", "id-ctrl", dev, "-o", "json")
+		writeCommandDump(filepath.Join(baseDir, "nvme-smart-log-"+sanitizeDumpName(dev)+".json"), "nvme", "smart-log", dev, "-o", "json")
+	}
+	return nil
+}
+
+func writeCommandDump(path, name string, args ...string) {
+	out, err := exec.Command(name, args...).CombinedOutput()
+	if err != nil && len(out) == 0 {
+		return
+	}
+	_ = os.WriteFile(path, out, 0644)
+}
+
+func writeROCmSMIDump(path string, args ...string) {
+	out, err := runROCmSMI(args...)
+	if err != nil && len(out) == 0 {
+		return
+	}
+	_ = os.WriteFile(path, out, 0644)
+}
+
+func lsblkDumpDevices(path string) []string {
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		return nil
+	}
+	var root lsblkDumpRoot
+	if err := json.Unmarshal(raw, &root); err != nil {
+		return nil
+	}
+	var devices []string
+	for _, dev := range root.Blockdevices {
+		if strings.EqualFold(strings.TrimSpace(dev.Tran), "usb") {
+			continue
+		}
+		if dev.Type == "disk" && strings.TrimSpace(dev.Name) != "" {
+			devices = append(devices, strings.TrimSpace(dev.Name))
+		}
+	}
+	sort.Strings(devices)
+	return devices
+}
+
+func nvmeDumpDevices(path string) []string {
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		return nil
+	}
+	var root nvmeDumpRoot
+	if err := json.Unmarshal(raw, &root); err != nil {
+		return nil
+	}
+	seen := map[string]bool{}
+	var devices []string
+	for _, dev := range root.Devices {
+		name := strings.TrimSpace(dev.DevicePath)
+		if name == "" || seen[name] {
+			continue
+		}
+		seen[name] = true
+		devices = append(devices, name)
+	}
+	sort.Strings(devices)
+	return devices
+}
+
+func sanitizeDumpName(value string) string {
+	value = strings.TrimSpace(value)
+	value = strings.TrimPrefix(value, "/dev/")
+	value = strings.ReplaceAll(value, "/", "_")
+	if value == "" {
+		return "unknown"
+	}
+	return value
+}

audit/internal/platform/techdump_test.go

@@ -0,0 +1,48 @@
+package platform
+
+import (
+	"os"
+	"path/filepath"
+	"reflect"
+	"testing"
+)
+
+func TestLSBLKDumpDevices(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+	path := filepath.Join(dir, "lsblk.json")
+	if err := os.WriteFile(path, []byte(`{"blockdevices":[{"name":"sda","type":"disk","tran":"usb"},{"name":"sda1","type":"part"},{"name":"nvme0n1","type":"disk","tran":"nvme"},{"name":"sdb","type":"disk","tran":"sata"}]}`), 0644); err != nil {
+		t.Fatalf("write lsblk fixture: %v", err)
+	}
+
+	got := lsblkDumpDevices(path)
+	want := []string{"nvme0n1", "sdb"}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("lsblkDumpDevices=%v want %v", got, want)
+	}
+}
+
+func TestNVMEDumpDevices(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+	path := filepath.Join(dir, "nvme-list.json")
+	if err := os.WriteFile(path, []byte(`{"Devices":[{"DevicePath":"/dev/nvme1n1"},{"DevicePath":"/dev/nvme0n1"},{"DevicePath":"/dev/nvme1n1"}]}`), 0644); err != nil {
+		t.Fatalf("write nvme fixture: %v", err)
+	}
+
+	got := nvmeDumpDevices(path)
+	want := []string{"/dev/nvme0n1", "/dev/nvme1n1"}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("nvmeDumpDevices=%v want %v", got, want)
+	}
+}
+
+func TestSanitizeDumpName(t *testing.T) {
+	t.Parallel()
+
+	if got := sanitizeDumpName("/dev/nvme0n1"); got != "nvme0n1" {
+		t.Fatalf("sanitizeDumpName=%q want nvme0n1", got)
+	}
+}

audit/internal/schema/hardware.go

@@ -10,9 +10,47 @@ type HardwareIngestRequest struct {
 	Protocol    *string          `json:"protocol,omitempty"`
 	TargetHost  *string          `json:"target_host,omitempty"`
 	CollectedAt string           `json:"collected_at"`
+	Runtime     *RuntimeHealth   `json:"runtime,omitempty"`
 	Hardware    HardwareSnapshot `json:"hardware"`
 }
 
+type RuntimeHealth struct {
+	Status        string                 `json:"status"`
+	CheckedAt     string                 `json:"checked_at"`
+	ExportDir     string                 `json:"export_dir,omitempty"`
+	DriverReady   bool                   `json:"driver_ready,omitempty"`
+	CUDAReady     bool                   `json:"cuda_ready,omitempty"`
+	NetworkStatus string                 `json:"network_status,omitempty"`
+	Issues        []RuntimeIssue         `json:"issues,omitempty"`
+	Tools         []RuntimeToolStatus    `json:"tools,omitempty"`
+	Services      []RuntimeServiceStatus `json:"services,omitempty"`
+	Interfaces    []RuntimeInterface     `json:"interfaces,omitempty"`
+}
+
+type RuntimeIssue struct {
+	Code        string `json:"code"`
+	Severity    string `json:"severity,omitempty"`
+	Description string `json:"description"`
+}
+
+type RuntimeToolStatus struct {
+	Name string `json:"name"`
+	Path string `json:"path,omitempty"`
+	OK   bool   `json:"ok"`
+}
+
+type RuntimeServiceStatus struct {
+	Name   string `json:"name"`
+	Status string `json:"status"`
+}
+
+type RuntimeInterface struct {
+	Name    string   `json:"name"`
+	State   string   `json:"state,omitempty"`
+	IPv4    []string `json:"ipv4,omitempty"`
+	Outcome string   `json:"outcome,omitempty"`
+}
+
 type HardwareSnapshot struct {
 	Board         HardwareBoard            `json:"board"`
 	Firmware      []HardwareFirmwareRecord `json:"firmware,omitempty"`
@@ -22,6 +60,7 @@ type HardwareSnapshot struct {
 	PCIeDevices   []HardwarePCIeDevice     `json:"pcie_devices,omitempty"`
 	PowerSupplies []HardwarePowerSupply    `json:"power_supplies,omitempty"`
 	Sensors       *HardwareSensors         `json:"sensors,omitempty"`
+	EventLogs     []HardwareEventLog       `json:"event_logs,omitempty"`
 }
 
 type HardwareHealthSummary struct {
@@ -148,7 +187,7 @@ type HardwarePCIeDevice struct {
 	SFPRXPowerDBM          *float64       `json:"sfp_rx_power_dbm,omitempty"`
 	SFPVoltageV            *float64       `json:"sfp_voltage_v,omitempty"`
 	SFPBiasMA              *float64       `json:"sfp_bias_ma,omitempty"`
-	BDF                    *string        `json:"bdf,omitempty"`
+	BDF                    *string        `json:"-"`
 	DeviceClass            *string        `json:"device_class,omitempty"`
 	Manufacturer           *string        `json:"manufacturer,omitempty"`
 	Model                  *string        `json:"model,omitempty"`
@@ -183,11 +222,12 @@ type HardwarePowerSupply struct {
 }
 
 type HardwareComponentStatus struct {
-	Status           *string                 `json:"status,omitempty"`
-	StatusCheckedAt  *string                 `json:"status_checked_at,omitempty"`
-	StatusChangedAt  *string                 `json:"status_changed_at,omitempty"`
-	StatusHistory    []HardwareStatusHistory `json:"status_history,omitempty"`
-	ErrorDescription *string                 `json:"error_description,omitempty"`
+	Status               *string                 `json:"status,omitempty"`
+	StatusCheckedAt      *string                 `json:"status_checked_at,omitempty"`
+	StatusChangedAt      *string                 `json:"status_changed_at,omitempty"`
+	StatusHistory        []HardwareStatusHistory `json:"status_history,omitempty"`
+	ErrorDescription     *string                 `json:"error_description,omitempty"`
+	ManufacturedYearWeek *string                 `json:"manufactured_year_week,omitempty"`
 }
 
 type HardwareStatusHistory struct {
@@ -235,3 +275,15 @@ type HardwareOtherSensor struct {
 	Unit     *string  `json:"unit,omitempty"`
 	Status   *string  `json:"status,omitempty"`
 }
+
+type HardwareEventLog struct {
+	Source       string         `json:"source"`
+	EventTime    *string        `json:"event_time,omitempty"`
+	Severity     *string        `json:"severity,omitempty"`
+	MessageID    *string        `json:"message_id,omitempty"`
+	Message      string         `json:"message"`
+	ComponentRef *string        `json:"component_ref,omitempty"`
+	Fingerprint  *string        `json:"fingerprint,omitempty"`
+	IsActive     *bool          `json:"is_active,omitempty"`
+	RawPayload   map[string]any `json:"raw_payload,omitempty"`
+}

audit/internal/schema/hardware_test.go

@@ -0,0 +1,46 @@
+package schema
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+)
+
+func TestHardwareSnapshotMarshalsNewContractFields(t *testing.T) {
+	week := "2024-W07"
+	eventTime := "2026-03-15T14:03:11Z"
+	message := "Correctable ECC error threshold exceeded"
+
+	payload := HardwareIngestRequest{
+		CollectedAt: "2026-03-15T15:00:00Z",
+		Hardware: HardwareSnapshot{
+			Board: HardwareBoard{SerialNumber: "SRV-001"},
+			CPUs: []HardwareCPU{
+				{
+					HardwareComponentStatus: HardwareComponentStatus{
+						ManufacturedYearWeek: &week,
+					},
+				},
+			},
+			EventLogs: []HardwareEventLog{
+				{
+					Source:    "bmc",
+					EventTime: &eventTime,
+					Message:   message,
+				},
+			},
+		},
+	}
+
+	data, err := json.Marshal(payload)
+	if err != nil {
+		t.Fatalf("marshal: %v", err)
+	}
+	text := string(data)
+	if !strings.Contains(text, `"manufactured_year_week":"2024-W07"`) {
+		t.Fatalf("missing manufactured_year_week: %s", text)
+	}
+	if !strings.Contains(text, `"event_logs":[{"source":"bmc","event_time":"2026-03-15T14:03:11Z","message":"Correctable ECC error threshold exceeded"}]`) {
+		t.Fatalf("missing event_logs payload: %s", text)
+	}
+}

audit/internal/tui/forms.go

@@ -1,6 +1,10 @@
 package tui
 
-import tea "github.com/charmbracelet/bubbletea"
+import (
+	"time"
+
+	tea "github.com/charmbracelet/bubbletea"
+)
 
 func (m model) updateStaticForm(msg tea.KeyMsg) (tea.Model, tea.Cmd) {
 	switch msg.String() {
@@ -63,7 +67,7 @@ func (m model) updateConfirm(msg tea.KeyMsg) (tea.Model, tea.Cmd) {
 		m.pendingAction = actionNone
 		return m, nil
 	case "enter":
-		if m.cursor == 1 {
+		if m.cursor == 1 { // Cancel
 			m.screen = m.confirmCancelTarget()
 			m.cursor = 0
 			m.pendingAction = actionNone
@@ -71,31 +75,68 @@ func (m model) updateConfirm(msg tea.KeyMsg) (tea.Model, tea.Cmd) {
 		}
 		m.busy = true
 		switch m.pendingAction {
-		case actionExportAudit:
-			m.busyTitle = "Export audit"
+		case actionExportBundle:
+			m.busyTitle = "Export support bundle"
 			target := *m.selectedTarget
 			return m, func() tea.Msg {
-				result, err := m.app.ExportLatestAuditResult(target)
+				result, err := m.app.ExportSupportBundleResult(target)
 				return resultMsg{title: result.Title, body: result.Body, err: err, back: screenMain}
 			}
-		case actionRunNvidiaSAT:
-			m.busyTitle = "NVIDIA SAT"
-			return m, func() tea.Msg {
-				result, err := m.app.RunNvidiaAcceptancePackResult("")
-				return resultMsg{title: result.Title, body: result.Body, err: err, back: screenAcceptance}
-			}
+		case actionRunAll:
+			return m.executeRunAll()
 		case actionRunMemorySAT:
-			m.busyTitle = "Memory SAT"
-			return m, func() tea.Msg {
-				result, err := m.app.RunMemoryAcceptancePackResult("")
-				return resultMsg{title: result.Title, body: result.Body, err: err, back: screenAcceptance}
-			}
+			m.busyTitle = "Memory test"
+			m.progressPrefix = "memory"
+			m.progressSince = time.Now()
+			m.progressLines = nil
+			since := m.progressSince
+			return m, tea.Batch(
+				func() tea.Msg {
+					result, err := m.app.RunMemoryAcceptancePackResult("")
+					return resultMsg{title: result.Title, body: result.Body, err: err, back: screenHealthCheck}
+				},
+				pollSATProgress("memory", since),
+			)
 		case actionRunStorageSAT:
-			m.busyTitle = "Storage SAT"
-			return m, func() tea.Msg {
-				result, err := m.app.RunStorageAcceptancePackResult("")
-				return resultMsg{title: result.Title, body: result.Body, err: err, back: screenAcceptance}
-			}
+			m.busyTitle = "Storage test"
+			m.progressPrefix = "storage"
+			m.progressSince = time.Now()
+			m.progressLines = nil
+			since := m.progressSince
+			return m, tea.Batch(
+				func() tea.Msg {
+					result, err := m.app.RunStorageAcceptancePackResult("")
+					return resultMsg{title: result.Title, body: result.Body, err: err, back: screenHealthCheck}
+				},
+				pollSATProgress("storage", since),
+			)
+		case actionRunCPUSAT:
+			m.busyTitle = "CPU test"
+			m.progressPrefix = "cpu"
+			m.progressSince = time.Now()
+			m.progressLines = nil
+			since := m.progressSince
+			durationSec := hcCPUDurations[m.hcMode]
+			return m, tea.Batch(
+				func() tea.Msg {
+					result, err := m.app.RunCPUAcceptancePackResult("", durationSec)
+					return resultMsg{title: result.Title, body: result.Body, err: err, back: screenHealthCheck}
+				},
+				pollSATProgress("cpu", since),
+			)
+		case actionRunAMDGPUSAT:
+			m.busyTitle = "AMD GPU test"
+			m.progressPrefix = "gpu-amd"
+			m.progressSince = time.Now()
+			m.progressLines = nil
+			since := m.progressSince
+			return m, tea.Batch(
+				func() tea.Msg {
+					result, err := m.app.RunAMDAcceptancePackResult("")
+					return resultMsg{title: result.Title, body: result.Body, err: err, back: screenHealthCheck}
+				},
+				pollSATProgress("gpu-amd", since),
+			)
 		}
 	case "ctrl+c":
 		return m, tea.Quit
@@ -105,14 +146,10 @@ func (m model) updateConfirm(msg tea.KeyMsg) (tea.Model, tea.Cmd) {
 
 func (m model) confirmCancelTarget() screen {
 	switch m.pendingAction {
-	case actionExportAudit:
+	case actionExportBundle:
 		return screenExportTargets
-	case actionRunNvidiaSAT:
-		fallthrough
-	case actionRunMemorySAT:
-		fallthrough
-	case actionRunStorageSAT:
-		return screenAcceptance
+	case actionRunAll, actionRunMemorySAT, actionRunStorageSAT, actionRunCPUSAT, actionRunAMDGPUSAT:
+		return screenHealthCheck
 	default:
 		return screenMain
 	}

audit/internal/tui/messages.go

@@ -1,6 +1,9 @@
 package tui
 
-import "bee/audit/internal/platform"
+import (
+	"bee/audit/internal/app"
+	"bee/audit/internal/platform"
+)
 
 type resultMsg struct {
 	title string
@@ -24,6 +27,20 @@ type exportTargetsMsg struct {
 	err     error
 }
 
-type bannerMsg struct {
-	text string
+type snapshotMsg struct {
+	banner string
+	panel  app.HardwarePanelData
+}
+
+type nvidiaGPUsMsg struct {
+	gpus []platform.NvidiaGPU
+	err  error
+}
+
+type nvtopClosedMsg struct{}
+
+type nvidiaSATDoneMsg struct {
+	title string
+	body  string
+	err   error
 }

audit/internal/tui/sat_progress.go

@@ -0,0 +1,131 @@
+package tui
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+
+	"bee/audit/internal/app"
+	tea "github.com/charmbracelet/bubbletea"
+)
+
+type satProgressMsg struct {
+	lines []string
+}
+
+// pollSATProgress returns a Cmd that waits 300ms then reads the latest verbose.log
+// for the given SAT prefix and returns parsed step progress lines.
+func pollSATProgress(prefix string, since time.Time) tea.Cmd {
+	return tea.Tick(300*time.Millisecond, func(_ time.Time) tea.Msg {
+		return satProgressMsg{lines: readSATProgressLines(prefix, since)}
+	})
+}
+
+func readSATProgressLines(prefix string, since time.Time) []string {
+	pattern := filepath.Join(app.DefaultSATBaseDir, prefix+"-*/verbose.log")
+	matches, err := filepath.Glob(pattern)
+	if err != nil || len(matches) == 0 {
+		return nil
+	}
+	sort.Strings(matches)
+	// Find the latest file created at or after (since - 5s) to account for clock skew.
+	cutoff := since.Add(-5 * time.Second)
+	candidate := ""
+	for _, m := range matches {
+		info, statErr := os.Stat(m)
+		if statErr == nil && info.ModTime().After(cutoff) {
+			candidate = m
+		}
+	}
+	if candidate == "" {
+		return nil
+	}
+	raw, err := os.ReadFile(candidate)
+	if err != nil {
+		return nil
+	}
+	return parseSATVerboseProgress(string(raw))
+}
+
+// parseSATVerboseProgress parses verbose.log content and returns display lines like:
+//
+//	"PASS  lscpu (234ms)"
+//	"FAIL  stress-ng (60.0s)"
+//	"...   sensors-after"
+func parseSATVerboseProgress(content string) []string {
+	type step struct {
+		name       string
+		rc         int
+		durationMs int
+		done       bool
+	}
+
+	lines := strings.Split(content, "\n")
+	var steps []step
+	stepIdx := map[string]int{}
+
+	for i, line := range lines {
+		line = strings.TrimSpace(line)
+		if idx := strings.Index(line, "] start "); idx >= 0 {
+			name := strings.TrimSpace(line[idx+len("] start "):])
+			if _, exists := stepIdx[name]; !exists {
+				stepIdx[name] = len(steps)
+				steps = append(steps, step{name: name})
+			}
+		} else if idx := strings.Index(line, "] finish "); idx >= 0 {
+			name := strings.TrimSpace(line[idx+len("] finish "):])
+			si, exists := stepIdx[name]
+			if !exists {
+				continue
+			}
+			steps[si].done = true
+			for j := i + 1; j < len(lines) && j <= i+3; j++ {
+				l := strings.TrimSpace(lines[j])
+				if strings.HasPrefix(l, "rc: ") {
+					steps[si].rc, _ = strconv.Atoi(strings.TrimPrefix(l, "rc: "))
+				} else if strings.HasPrefix(l, "duration_ms: ") {
+					steps[si].durationMs, _ = strconv.Atoi(strings.TrimPrefix(l, "duration_ms: "))
+				}
+			}
+		}
+	}
+
+	var result []string
+	for _, s := range steps {
+		display := cleanSATStepName(s.name)
+		if s.done {
+			status := "PASS"
+			if s.rc != 0 {
+				status = "FAIL"
+			}
+			result = append(result, fmt.Sprintf("%-4s  %s (%s)", status, display, fmtDurMs(s.durationMs)))
+		} else {
+			result = append(result, fmt.Sprintf("...   %s", display))
+		}
+	}
+	return result
+}
+
+// cleanSATStepName strips leading digits and dash: "01-lscpu.log" → "lscpu".
+func cleanSATStepName(name string) string {
+	name = strings.TrimSuffix(name, ".log")
+	i := 0
+	for i < len(name) && name[i] >= '0' && name[i] <= '9' {
+		i++
+	}
+	if i < len(name) && name[i] == '-' {
+		name = name[i+1:]
+	}
+	return name
+}
+
+func fmtDurMs(ms int) string {
+	if ms < 1000 {
+		return fmt.Sprintf("%dms", ms)
+	}
+	return fmt.Sprintf("%.1fs", float64(ms)/1000)
+}

audit/internal/tui/screen_acceptance.go

@@ -1,21 +0,0 @@
-package tui
-
-import tea "github.com/charmbracelet/bubbletea"
-
-func (m model) handleAcceptanceMenu() (tea.Model, tea.Cmd) {
-	if m.cursor == 3 {
-		m.screen = screenMain
-		m.cursor = 0
-		return m, nil
-	}
-	switch m.cursor {
-	case 0:
-		m.pendingAction = actionRunNvidiaSAT
-	case 1:
-		m.pendingAction = actionRunMemorySAT
-	case 2:
-		m.pendingAction = actionRunStorageSAT
-	}
-	m.screen = screenConfirm
-	return m, nil
-}

audit/internal/tui/screen_export.go

@@ -4,11 +4,11 @@ import tea "github.com/charmbracelet/bubbletea"
 
 func (m model) handleExportTargetsMenu() (tea.Model, tea.Cmd) {
 	if len(m.targets) == 0 {
-		return m, resultCmd("Export audit", "No removable filesystems found", nil, screenMain)
+		return m, resultCmd("Export support bundle", "No removable filesystems found", nil, screenMain)
 	}
 	target := m.targets[m.cursor]
 	m.selectedTarget = &target
-	m.pendingAction = actionExportAudit
+	m.pendingAction = actionExportBundle
 	m.screen = screenConfirm
 	return m, nil
 }

audit/internal/tui/screen_health_check.go

@@ -0,0 +1,307 @@
+package tui
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	tea "github.com/charmbracelet/bubbletea"
+)
+
+// Component indices.
+const (
+	hcGPU     = 0
+	hcMemory  = 1
+	hcStorage = 2
+	hcCPU     = 3
+)
+
+// Cursor positions in Health Check screen.
+const (
+	hcCurGPU       = 0
+	hcCurMemory    = 1
+	hcCurStorage   = 2
+	hcCurCPU       = 3
+	hcCurSelectAll = 4
+	hcCurModeQuick = 5
+	hcCurModeStd   = 6
+	hcCurModeExpr  = 7
+	hcCurRunAll    = 8
+	hcCurTotal     = 9
+)
+
+// hcModeDurations maps mode index (0=Quick,1=Standard,2=Express) to GPU stress seconds.
+var hcModeDurations = [3]int{600, 3600, 28800}
+
+// hcCPUDurations maps mode index to CPU stress-ng seconds.
+var hcCPUDurations = [3]int{60, 300, 900}
+
+func (m model) enterHealthCheck() (tea.Model, tea.Cmd) {
+	m.screen = screenHealthCheck
+	if !m.hcInitialized {
+		m.hcSel = [4]bool{true, true, true, true}
+		m.hcMode = 0
+		m.hcCursor = 0
+		m.hcInitialized = true
+	}
+	return m, nil
+}
+
+func (m model) updateHealthCheck(msg tea.KeyMsg) (tea.Model, tea.Cmd) {
+	switch msg.String() {
+	case "up", "k":
+		if m.hcCursor > 0 {
+			m.hcCursor--
+		}
+	case "down", "j":
+		if m.hcCursor < hcCurTotal-1 {
+			m.hcCursor++
+		}
+	case " ":
+		switch m.hcCursor {
+		case hcCurGPU, hcCurMemory, hcCurStorage, hcCurCPU:
+			m.hcSel[m.hcCursor] = !m.hcSel[m.hcCursor]
+		case hcCurSelectAll:
+			allOn := m.hcSel[0] && m.hcSel[1] && m.hcSel[2] && m.hcSel[3]
+			for i := range m.hcSel {
+				m.hcSel[i] = !allOn
+			}
+		case hcCurModeQuick, hcCurModeStd, hcCurModeExpr:
+			m.hcMode = m.hcCursor - hcCurModeQuick
+		}
+	case "enter":
+		switch m.hcCursor {
+		case hcCurGPU, hcCurMemory, hcCurStorage, hcCurCPU:
+			return m.hcRunSingle(m.hcCursor)
+		case hcCurSelectAll:
+			allOn := m.hcSel[0] && m.hcSel[1] && m.hcSel[2] && m.hcSel[3]
+			for i := range m.hcSel {
+				m.hcSel[i] = !allOn
+			}
+		case hcCurModeQuick, hcCurModeStd, hcCurModeExpr:
+			m.hcMode = m.hcCursor - hcCurModeQuick
+		case hcCurRunAll:
+			return m.hcRunAll()
+		}
+	case "g", "G":
+		return m.hcRunSingle(hcGPU)
+	case "m", "M":
+		return m.hcRunSingle(hcMemory)
+	case "s", "S":
+		return m.hcRunSingle(hcStorage)
+	case "c", "C":
+		return m.hcRunSingle(hcCPU)
+	case "r", "R":
+		return m.hcRunAll()
+	case "a", "A":
+		allOn := m.hcSel[0] && m.hcSel[1] && m.hcSel[2] && m.hcSel[3]
+		for i := range m.hcSel {
+			m.hcSel[i] = !allOn
+		}
+	case "1":
+		m.hcMode = 0
+	case "2":
+		m.hcMode = 1
+	case "3":
+		m.hcMode = 2
+	case "esc":
+		m.screen = screenMain
+		m.cursor = 0
+	case "q", "ctrl+c":
+		return m, tea.Quit
+	}
+	return m, nil
+}
+
+func (m model) hcRunSingle(idx int) (tea.Model, tea.Cmd) {
+	switch idx {
+	case hcGPU:
+		if m.app.DetectGPUVendor() == "amd" {
+			m.pendingAction = actionRunAMDGPUSAT
+			m.screen = screenConfirm
+			m.cursor = 0
+			return m, nil
+		}
+		m.nvidiaDurIdx = m.hcMode
+		return m.enterNvidiaSATSetup()
+	case hcMemory:
+		m.pendingAction = actionRunMemorySAT
+		m.screen = screenConfirm
+		m.cursor = 0
+		return m, nil
+	case hcStorage:
+		m.pendingAction = actionRunStorageSAT
+		m.screen = screenConfirm
+		m.cursor = 0
+		return m, nil
+	case hcCPU:
+		m.pendingAction = actionRunCPUSAT
+		m.screen = screenConfirm
+		m.cursor = 0
+		return m, nil
+	}
+	return m, nil
+}
+
+func (m model) hcRunAll() (tea.Model, tea.Cmd) {
+	for _, sel := range m.hcSel {
+		if sel {
+			m.pendingAction = actionRunAll
+			m.screen = screenConfirm
+			m.cursor = 0
+			return m, nil
+		}
+	}
+	return m, nil
+}
+
+func (m model) executeRunAll() (tea.Model, tea.Cmd) {
+	durationSec := hcModeDurations[m.hcMode]
+	durationIdx := m.hcMode
+	sel := m.hcSel
+	app := m.app
+	m.busy = true
+	m.busyTitle = "Health Check"
+	return m, func() tea.Msg {
+		var parts []string
+		if sel[hcGPU] {
+			vendor := app.DetectGPUVendor()
+			if vendor == "amd" {
+				r, err := app.RunAMDAcceptancePackResult("")
+				body := r.Body
+				if err != nil {
+					body += "\nERROR: " + err.Error()
+				}
+				parts = append(parts, "=== GPU (AMD) ===\n"+body)
+			} else {
+				gpus, err := app.ListNvidiaGPUs()
+				if err != nil || len(gpus) == 0 {
+					parts = append(parts, "=== GPU ===\nNo NVIDIA GPUs detected or driver not loaded.")
+				} else {
+					var indices []int
+					sizeMB := 0
+					for _, g := range gpus {
+						indices = append(indices, g.Index)
+						if sizeMB == 0 || g.MemoryMB < sizeMB {
+							sizeMB = g.MemoryMB
+						}
+					}
+					if sizeMB == 0 {
+						sizeMB = 64
+					}
+					r, err := app.RunNvidiaAcceptancePackWithOptions(context.Background(), "", durationSec, sizeMB, indices)
+					body := r.Body
+					if err != nil {
+						body += "\nERROR: " + err.Error()
+					}
+					parts = append(parts, "=== GPU ===\n"+body)
+				}
+			}
+		}
+		if sel[hcMemory] {
+			r, err := app.RunMemoryAcceptancePackResult("")
+			body := r.Body
+			if err != nil {
+				body += "\nERROR: " + err.Error()
+			}
+			parts = append(parts, "=== MEMORY ===\n"+body)
+		}
+		if sel[hcStorage] {
+			r, err := app.RunStorageAcceptancePackResult("")
+			body := r.Body
+			if err != nil {
+				body += "\nERROR: " + err.Error()
+			}
+			parts = append(parts, "=== STORAGE ===\n"+body)
+		}
+		if sel[hcCPU] {
+			cpuDur := hcCPUDurations[durationIdx]
+			r, err := app.RunCPUAcceptancePackResult("", cpuDur)
+			body := r.Body
+			if err != nil {
+				body += "\nERROR: " + err.Error()
+			}
+			parts = append(parts, "=== CPU ===\n"+body)
+		}
+		combined := strings.Join(parts, "\n\n")
+		if combined == "" {
+			combined = "No components selected."
+		}
+		return resultMsg{title: "Health Check", body: combined, back: screenHealthCheck}
+	}
+}
+
+func renderHealthCheck(m model) string {
+	var b strings.Builder
+
+	fmt.Fprintln(&b, "HEALTH CHECK")
+	fmt.Fprintln(&b)
+	fmt.Fprintln(&b, "  Diagnostics:")
+	fmt.Fprintln(&b)
+
+	type comp struct{ name, desc, key string }
+	comps := []comp{
+		{"GPU", "nvidia/amd auto-detect", "G"},
+		{"MEMORY", "memtester", "M"},
+		{"STORAGE", "smartctl + NVMe self-test", "S"},
+		{"CPU", "audit diagnostics", "C"},
+	}
+	for i, c := range comps {
+		pfx := "  "
+		if m.hcCursor == i {
+			pfx = "> "
+		}
+		ch := "[ ]"
+		if m.hcSel[i] {
+			ch = "[x]"
+		}
+		fmt.Fprintf(&b, "%s%s  %-8s  %-28s [%s]\n", pfx, ch, c.name, c.desc, c.key)
+	}
+
+	fmt.Fprintln(&b, "  ─────────────────────────────────────────────────")
+	{
+		pfx := "  "
+		if m.hcCursor == hcCurSelectAll {
+			pfx = "> "
+		}
+		allOn := m.hcSel[0] && m.hcSel[1] && m.hcSel[2] && m.hcSel[3]
+		ch := "[ ]"
+		if allOn {
+			ch = "[x]"
+		}
+		fmt.Fprintf(&b, "%s%s  Select / Deselect All                        [A]\n", pfx, ch)
+	}
+
+	fmt.Fprintln(&b)
+	fmt.Fprintln(&b, "  Mode:")
+	modes := []struct{ label, key string }{
+		{"Quick", "1"},
+		{"Standard", "2"},
+		{"Express", "3"},
+	}
+	for i, mode := range modes {
+		pfx := "  "
+		if m.hcCursor == hcCurModeQuick+i {
+			pfx = "> "
+		}
+		radio := "( )"
+		if m.hcMode == i {
+			radio = "(*)"
+		}
+		fmt.Fprintf(&b, "%s%s  %-10s  [%s]\n", pfx, radio, mode.label, mode.key)
+	}
+
+	fmt.Fprintln(&b)
+	{
+		pfx := "  "
+		if m.hcCursor == hcCurRunAll {
+			pfx = "> "
+		}
+		fmt.Fprintf(&b, "%s[ RUN ALL [R] ]\n", pfx)
+	}
+
+	fmt.Fprintln(&b)
+	fmt.Fprintln(&b, "─────────────────────────────────────────────────────────────────")
+	fmt.Fprint(&b, "[↑↓] move  [space/enter] toggle  [letter] single test  [R] run all  [Esc] back")
+	return b.String()
+}

audit/internal/tui/screen_main.go

@@ -6,57 +6,21 @@ import (
 
 func (m model) handleMainMenu() (tea.Model, tea.Cmd) {
 	switch m.cursor {
-	case 0:
-		m.screen = screenNetwork
-		m.cursor = 0
-		return m, nil
-	case 1:
+	case 0: // Health Check
+		return m.enterHealthCheck()
+	case 1: // Export support bundle
+		m.pendingAction = actionExportBundle
 		m.busy = true
-		m.busyTitle = "Services"
-		return m, func() tea.Msg {
-			services, err := m.app.ListBeeServices()
-			return servicesMsg{services: services, err: err}
-		}
-	case 2:
-		m.screen = screenAcceptance
-		m.cursor = 0
-		return m, nil
-	case 3:
-		m.busy = true
-		m.busyTitle = "Run audit"
-		return m, func() tea.Msg {
-			result, err := m.app.RunAuditNow(m.runtimeMode)
-			return resultMsg{title: result.Title, body: result.Body, err: err, back: screenMain}
-		}
-	case 4:
-		m.busy = true
-		m.busyTitle = "Export audit"
+		m.busyTitle = "Export support bundle"
 		return m, func() tea.Msg {
 			targets, err := m.app.ListRemovableTargets()
 			return exportTargetsMsg{targets: targets, err: err}
 		}
-	case 5:
-		m.busy = true
-		m.busyTitle = "Required tools"
-		return m, func() tea.Msg {
-			result := m.app.ToolCheckResult([]string{"dmidecode", "smartctl", "nvme", "ipmitool", "lspci", "ethtool", "bee", "nvidia-smi", "bee-gpu-stress", "memtester", "dhclient", "lsblk", "mount"})
-			return resultMsg{title: result.Title, body: result.Body, back: screenMain}
-		}
-	case 6:
-		m.busy = true
-		m.busyTitle = "Health summary"
-		return m, func() tea.Msg {
-			result := m.app.HealthSummaryResult()
-			return resultMsg{title: result.Title, body: result.Body, back: screenMain}
-		}
-	case 7:
-		m.busy = true
-		m.busyTitle = "Audit logs"
-		return m, func() tea.Msg {
-			result := m.app.AuditLogTailResult()
-			return resultMsg{title: result.Title, body: result.Body, back: screenMain}
-		}
-	case 8:
+	case 2: // Settings
+		m.screen = screenSettings
+		m.cursor = 0
+		return m, nil
+	case 3: // Exit
 		return m, tea.Quit
 	}
 	return m, nil

audit/internal/tui/screen_network.go

@@ -39,7 +39,7 @@ func (m model) handleNetworkMenu() (tea.Model, tea.Cmd) {
 			return interfacesMsg{ifaces: ifaces, err: err}
 		}
 	case 4:
-		m.screen = screenMain
+		m.screen = screenSettings
 		m.cursor = 0
 		return m, nil
 	}

audit/internal/tui/screen_nvidia_sat.go

@@ -0,0 +1,238 @@
+package tui
+
+import (
+	"context"
+	"fmt"
+	"os/exec"
+	"strings"
+
+	"bee/audit/internal/platform"
+
+	tea "github.com/charmbracelet/bubbletea"
+)
+
+var nvidiaDurationOptions = []struct {
+	label   string
+	seconds int
+}{
+	{"10 minutes", 600},
+	{"1 hour", 3600},
+	{"8 hours", 28800},
+	{"24 hours", 86400},
+}
+
+// enterNvidiaSATSetup resets the setup screen and starts loading GPU list.
+func (m model) enterNvidiaSATSetup() (tea.Model, tea.Cmd) {
+	m.screen = screenNvidiaSATSetup
+	m.nvidiaGPUs = nil
+	m.nvidiaGPUSel = nil
+	m.nvidiaDurIdx = 0
+	m.nvidiaSATCursor = 0
+	m.busy = true
+	m.busyTitle = "NVIDIA SAT"
+	return m, func() tea.Msg {
+		gpus, err := m.app.ListNvidiaGPUs()
+		return nvidiaGPUsMsg{gpus: gpus, err: err}
+	}
+}
+
+// handleNvidiaGPUsMsg processes the GPU list response.
+func (m model) handleNvidiaGPUsMsg(msg nvidiaGPUsMsg) (tea.Model, tea.Cmd) {
+	m.busy = false
+	m.busyTitle = ""
+	if msg.err != nil {
+		m.title = "NVIDIA SAT"
+		m.body = fmt.Sprintf("Failed to list GPUs: %v", msg.err)
+		m.prevScreen = screenHealthCheck
+		m.screen = screenOutput
+		return m, nil
+	}
+	m.nvidiaGPUs = msg.gpus
+	m.nvidiaGPUSel = make([]bool, len(msg.gpus))
+	for i := range m.nvidiaGPUSel {
+		m.nvidiaGPUSel[i] = true // all selected by default
+	}
+	m.nvidiaSATCursor = 0
+	return m, nil
+}
+
+// updateNvidiaSATSetup handles keys on the setup screen.
+func (m model) updateNvidiaSATSetup(msg tea.KeyMsg) (tea.Model, tea.Cmd) {
+	numDur := len(nvidiaDurationOptions)
+	numGPU := len(m.nvidiaGPUs)
+	totalItems := numDur + numGPU + 2 // +2: Start, Cancel
+	switch msg.String() {
+	case "up", "k":
+		if m.nvidiaSATCursor > 0 {
+			m.nvidiaSATCursor--
+		}
+	case "down", "j":
+		if m.nvidiaSATCursor < totalItems-1 {
+			m.nvidiaSATCursor++
+		}
+	case " ":
+		switch {
+		case m.nvidiaSATCursor < numDur:
+			m.nvidiaDurIdx = m.nvidiaSATCursor
+		case m.nvidiaSATCursor < numDur+numGPU:
+			i := m.nvidiaSATCursor - numDur
+			m.nvidiaGPUSel[i] = !m.nvidiaGPUSel[i]
+		}
+	case "enter":
+		startIdx := numDur + numGPU
+		cancelIdx := startIdx + 1
+		switch {
+		case m.nvidiaSATCursor < numDur:
+			m.nvidiaDurIdx = m.nvidiaSATCursor
+		case m.nvidiaSATCursor < startIdx:
+			i := m.nvidiaSATCursor - numDur
+			m.nvidiaGPUSel[i] = !m.nvidiaGPUSel[i]
+		case m.nvidiaSATCursor == startIdx:
+			return m.startNvidiaSAT()
+		case m.nvidiaSATCursor == cancelIdx:
+			m.screen = screenHealthCheck
+			m.cursor = 0
+		}
+	case "esc":
+		m.screen = screenHealthCheck
+		m.cursor = 0
+	case "ctrl+c", "q":
+		return m, tea.Quit
+	}
+	return m, nil
+}
+
+// startNvidiaSAT launches the SAT and nvtop.
+func (m model) startNvidiaSAT() (tea.Model, tea.Cmd) {
+	var selectedGPUs []platform.NvidiaGPU
+	for i, sel := range m.nvidiaGPUSel {
+		if sel {
+			selectedGPUs = append(selectedGPUs, m.nvidiaGPUs[i])
+		}
+	}
+	if len(selectedGPUs) == 0 {
+		selectedGPUs = m.nvidiaGPUs // fallback: use all if none explicitly selected
+	}
+
+	sizeMB := 0
+	for _, g := range selectedGPUs {
+		if sizeMB == 0 || g.MemoryMB < sizeMB {
+			sizeMB = g.MemoryMB
+		}
+	}
+	if sizeMB == 0 {
+		sizeMB = 64
+	}
+
+	var gpuIndices []int
+	for _, g := range selectedGPUs {
+		gpuIndices = append(gpuIndices, g.Index)
+	}
+
+	durationSec := nvidiaDurationOptions[m.nvidiaDurIdx].seconds
+
+	ctx, cancel := context.WithCancel(context.Background())
+	m.nvidiaSATCancel = cancel
+	m.nvidiaSATAborted = false
+	m.screen = screenNvidiaSATRunning
+	m.nvidiaSATCursor = 0
+
+	satCmd := func() tea.Msg {
+		result, err := m.app.RunNvidiaAcceptancePackWithOptions(ctx, "", durationSec, sizeMB, gpuIndices)
+		return nvidiaSATDoneMsg{title: result.Title, body: result.Body, err: err}
+	}
+
+	nvtopPath, lookErr := exec.LookPath("nvtop")
+	if lookErr != nil {
+		// nvtop not available: just run the SAT, show running screen
+		return m, satCmd
+	}
+
+	return m, tea.Batch(
+		satCmd,
+		tea.ExecProcess(exec.Command(nvtopPath), func(_ error) tea.Msg {
+			return nvtopClosedMsg{}
+		}),
+	)
+}
+
+// updateNvidiaSATRunning handles keys on the running screen.
+func (m model) updateNvidiaSATRunning(msg tea.KeyMsg) (tea.Model, tea.Cmd) {
+	switch msg.String() {
+	case "o", "O":
+		nvtopPath, err := exec.LookPath("nvtop")
+		if err != nil {
+			return m, nil
+		}
+		return m, tea.ExecProcess(exec.Command(nvtopPath), func(_ error) tea.Msg {
+			return nvtopClosedMsg{}
+		})
+	case "a", "A":
+		if m.nvidiaSATCancel != nil {
+			m.nvidiaSATCancel()
+			m.nvidiaSATCancel = nil
+		}
+		m.nvidiaSATAborted = true
+		m.screen = screenHealthCheck
+		m.cursor = 0
+	case "ctrl+c":
+		return m, tea.Quit
+	}
+	return m, nil
+}
+
+// renderNvidiaSATSetup renders the setup screen.
+func renderNvidiaSATSetup(m model) string {
+	var b strings.Builder
+	fmt.Fprintln(&b, "NVIDIA SAT")
+	fmt.Fprintln(&b)
+	fmt.Fprintln(&b, "Duration:")
+	for i, opt := range nvidiaDurationOptions {
+		radio := "( )"
+		if i == m.nvidiaDurIdx {
+			radio = "(*)"
+		}
+		prefix := "  "
+		if m.nvidiaSATCursor == i {
+			prefix = "> "
+		}
+		fmt.Fprintf(&b, "%s%s %s\n", prefix, radio, opt.label)
+	}
+	fmt.Fprintln(&b)
+	if len(m.nvidiaGPUs) == 0 {
+		fmt.Fprintln(&b, "GPUs: (none detected)")
+	} else {
+		fmt.Fprintln(&b, "GPUs:")
+		for i, gpu := range m.nvidiaGPUs {
+			check := "[ ]"
+			if m.nvidiaGPUSel[i] {
+				check = "[x]"
+			}
+			prefix := "  "
+			if m.nvidiaSATCursor == len(nvidiaDurationOptions)+i {
+				prefix = "> "
+			}
+			fmt.Fprintf(&b, "%s%s %d: %s (%d MB)\n", prefix, check, gpu.Index, gpu.Name, gpu.MemoryMB)
+		}
+	}
+	fmt.Fprintln(&b)
+	startIdx := len(nvidiaDurationOptions) + len(m.nvidiaGPUs)
+	startPfx := "  "
+	cancelPfx := "  "
+	if m.nvidiaSATCursor == startIdx {
+		startPfx = "> "
+	}
+	if m.nvidiaSATCursor == startIdx+1 {
+		cancelPfx = "> "
+	}
+	fmt.Fprintf(&b, "%sStart\n", startPfx)
+	fmt.Fprintf(&b, "%sCancel\n", cancelPfx)
+	fmt.Fprintln(&b)
+	b.WriteString("[↑/↓] move  [space] toggle  [enter] select  [esc] cancel\n")
+	return b.String()
+}
+
+// renderNvidiaSATRunning renders the running screen.
+func renderNvidiaSATRunning() string {
+	return "NVIDIA SAT\n\nTest is running...\n\n[o] Open nvtop  [a] Abort test  [ctrl+c] quit\n"
+}

audit/internal/tui/screen_services.go

@@ -8,7 +8,7 @@ import (
 
 func (m model) handleServicesMenu() (tea.Model, tea.Cmd) {
 	if len(m.services) == 0 {
-		return m, resultCmd("Services", "No bee-* services found.", nil, screenMain)
+		return m, resultCmd("Services", "No bee-* services found.", nil, screenSettings)
 	}
 	m.selectedService = m.services[m.cursor]
 	m.screen = screenServiceAction

audit/internal/tui/screen_settings.go

@@ -0,0 +1,64 @@
+package tui
+
+import tea "github.com/charmbracelet/bubbletea"
+
+func (m model) handleSettingsMenu() (tea.Model, tea.Cmd) {
+	switch m.cursor {
+	case 0: // Network
+		m.screen = screenNetwork
+		m.cursor = 0
+		return m, nil
+	case 1: // Services
+		m.busy = true
+		m.busyTitle = "Services"
+		return m, func() tea.Msg {
+			services, err := m.app.ListBeeServices()
+			return servicesMsg{services: services, err: err}
+		}
+	case 2: // Re-run audit
+		m.busy = true
+		m.busyTitle = "Re-run audit"
+		runtimeMode := m.runtimeMode
+		return m, func() tea.Msg {
+			result, err := m.app.RunAuditNow(runtimeMode)
+			return resultMsg{title: result.Title, body: result.Body, err: err, back: screenSettings}
+		}
+	case 3: // Run self-check
+		m.busy = true
+		m.busyTitle = "Self-check"
+		return m, func() tea.Msg {
+			result, err := m.app.RunRuntimePreflightResult()
+			return resultMsg{title: result.Title, body: result.Body, err: err, back: screenSettings}
+		}
+	case 4: // Runtime issues
+		m.busy = true
+		m.busyTitle = "Runtime issues"
+		return m, func() tea.Msg {
+			result := m.app.RuntimeHealthResult()
+			return resultMsg{title: result.Title, body: result.Body, back: screenSettings}
+		}
+	case 5: // Audit logs
+		m.busy = true
+		m.busyTitle = "Audit logs"
+		return m, func() tea.Msg {
+			result := m.app.AuditLogTailResult()
+			return resultMsg{title: result.Title, body: result.Body, back: screenSettings}
+		}
+	case 6: // Check tools
+		m.busy = true
+		m.busyTitle = "Check tools"
+		return m, func() tea.Msg {
+			result := m.app.ToolCheckResult([]string{
+				"dmidecode", "smartctl", "nvme", "ipmitool", "lspci",
+				"ethtool", "bee", "nvidia-smi", "bee-gpu-stress",
+				"memtester", "dhclient", "lsblk", "mount",
+			})
+			return resultMsg{title: result.Title, body: result.Body, back: screenSettings}
+		}
+	case 7: // Back
+		m.screen = screenMain
+		m.cursor = 0
+		return m, nil
+	}
+	return m, nil
+}

audit/internal/tui/snapshot.go

@@ -0,0 +1,30 @@
+package tui
+
+import (
+	"bee/audit/internal/app"
+
+	tea "github.com/charmbracelet/bubbletea"
+)
+
+func (m model) refreshSnapshotCmd() tea.Cmd {
+	if m.app == nil {
+		return nil
+	}
+	return func() tea.Msg {
+		return snapshotMsg{
+			banner: m.app.MainBanner(),
+			panel:  m.app.LoadHardwarePanel(),
+		}
+	}
+}
+
+func shouldRefreshSnapshot(prev, next model) bool {
+	return prev.screen != next.screen || prev.busy != next.busy
+}
+
+func emptySnapshot() snapshotMsg {
+	return snapshotMsg{
+		banner: "",
+		panel:  app.HardwarePanelData{},
+	}
+}

audit/internal/tui/tui_test.go

@@ -53,11 +53,10 @@ func TestUpdateMainMenuEnterActions(t *testing.T) {
 		wantBusy   bool
 		wantCmd    bool
 	}{
-		{name: "network", cursor: 0, wantScreen: screenNetwork},
-		{name: "services", cursor: 1, wantScreen: screenMain, wantBusy: true, wantCmd: true},
-		{name: "acceptance", cursor: 2, wantScreen: screenAcceptance},
-		{name: "run audit", cursor: 3, wantScreen: screenMain, wantBusy: true, wantCmd: true},
-		{name: "export", cursor: 4, wantScreen: screenMain, wantBusy: true, wantCmd: true},
+		{name: "health_check", cursor: 0, wantScreen: screenHealthCheck, wantCmd: true},
+		{name: "export", cursor: 1, wantScreen: screenMain, wantBusy: true, wantCmd: true},
+		{name: "settings", cursor: 2, wantScreen: screenSettings, wantCmd: true},
+		{name: "exit", cursor: 3, wantScreen: screenMain, wantCmd: true},
 	}
 
 	for _, test := range tests {
@@ -89,7 +88,7 @@ func TestUpdateConfirmCancelViaKeys(t *testing.T) {
 
 	m := newTestModel()
 	m.screen = screenConfirm
-	m.pendingAction = actionRunNvidiaSAT
+	m.pendingAction = actionRunMemorySAT
 
 	next, _ := m.Update(tea.KeyMsg{Type: tea.KeyRight})
 	got := next.(model)
@@ -99,8 +98,8 @@ func TestUpdateConfirmCancelViaKeys(t *testing.T) {
 
 	next, _ = got.Update(tea.KeyMsg{Type: tea.KeyEnter})
 	got = next.(model)
-	if got.screen != screenAcceptance {
-		t.Fatalf("screen=%q want %q", got.screen, screenAcceptance)
+	if got.screen != screenHealthCheck {
+		t.Fatalf("screen=%q want %q", got.screen, screenHealthCheck)
 	}
 	if got.cursor != 0 {
 		t.Fatalf("cursor=%d want 0 after cancel", got.cursor)
@@ -115,8 +114,8 @@ func TestMainMenuSimpleTransitions(t *testing.T) {
 		cursor     int
 		wantScreen screen
 	}{
-		{name: "network", cursor: 0, wantScreen: screenNetwork},
-		{name: "acceptance", cursor: 2, wantScreen: screenAcceptance},
+		{name: "health_check", cursor: 0, wantScreen: screenHealthCheck},
+		{name: "settings", cursor: 2, wantScreen: screenSettings},
 	}
 
 	for _, test := range tests {
@@ -143,57 +142,42 @@ func TestMainMenuSimpleTransitions(t *testing.T) {
 	}
 }
 
-func TestMainMenuAsyncActionsSetBusy(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name   string
-		cursor int
-	}{
-		{name: "services", cursor: 1},
-		{name: "run audit", cursor: 3},
-		{name: "export", cursor: 4},
-		{name: "check tools", cursor: 5},
-		{name: "health summary", cursor: 6},
-		{name: "log tail", cursor: 7},
-	}
-
-	for _, test := range tests {
-		test := test
-		t.Run(test.name, func(t *testing.T) {
-			t.Parallel()
-
-			m := newTestModel()
-			m.cursor = test.cursor
-
-			next, cmd := m.handleMainMenu()
-			got := next.(model)
-
-			if !got.busy {
-				t.Fatalf("busy=false for %s", test.name)
-			}
-			if cmd == nil {
-				t.Fatalf("expected async cmd for %s", test.name)
-			}
-		})
-	}
-}
-
-func TestMainViewIncludesBanner(t *testing.T) {
+func TestMainMenuExportSetsBusy(t *testing.T) {
 	t.Parallel()
 
 	m := newTestModel()
-	m.banner = "System: Test Server | S/N ABC123\nIP: 10.0.0.10"
+	m.cursor = 1 // Export support bundle
+
+	next, cmd := m.handleMainMenu()
+	got := next.(model)
+
+	if !got.busy {
+		t.Fatal("busy=false for export")
+	}
+	if cmd == nil {
+		t.Fatal("expected async cmd for export")
+	}
+}
+
+func TestMainViewRendersTwoColumns(t *testing.T) {
+	t.Parallel()
+
+	m := newTestModel()
+	m.cursor = 1
 
 	view := m.View()
-	if !strings.Contains(view, "System: Test Server | S/N ABC123") {
-		t.Fatalf("view missing system banner:\n%s", view)
-	}
-	if !strings.Contains(view, "IP: 10.0.0.10") {
-		t.Fatalf("view missing ip banner:\n%s", view)
-	}
-	if !strings.Contains(view, "Select action") {
-		t.Fatalf("view missing menu subtitle:\n%s", view)
+	for _, want := range []string{
+		"bee",
+		"Health Check",
+		"> Export support bundle",
+		"Settings",
+		"Exit",
+		"│",
+		"[↑↓] move",
+	} {
+		if !strings.Contains(view, want) {
+			t.Fatalf("view missing %q\nview:\n%s", want, view)
+		}
 	}
 }
 
@@ -205,9 +189,9 @@ func TestEscapeNavigation(t *testing.T) {
 		screen     screen
 		wantScreen screen
 	}{
-		{name: "network to main", screen: screenNetwork, wantScreen: screenMain},
-		{name: "services to main", screen: screenServices, wantScreen: screenMain},
-		{name: "acceptance to main", screen: screenAcceptance, wantScreen: screenMain},
+		{name: "network to settings", screen: screenNetwork, wantScreen: screenSettings},
+		{name: "services to settings", screen: screenServices, wantScreen: screenSettings},
+		{name: "settings to main", screen: screenSettings, wantScreen: screenMain},
 		{name: "service action to services", screen: screenServiceAction, wantScreen: screenServices},
 		{name: "export targets to main", screen: screenExportTargets, wantScreen: screenMain},
 		{name: "interface pick to network", screen: screenInterfacePick, wantScreen: screenNetwork},
@@ -235,6 +219,24 @@ func TestEscapeNavigation(t *testing.T) {
 	}
 }
 
+func TestHealthCheckEscReturnsToMain(t *testing.T) {
+	t.Parallel()
+
+	m := newTestModel()
+	m.screen = screenHealthCheck
+	m.hcCursor = 3
+
+	next, _ := m.updateHealthCheck(tea.KeyMsg{Type: tea.KeyEsc})
+	got := next.(model)
+
+	if got.screen != screenMain {
+		t.Fatalf("screen=%q want %q", got.screen, screenMain)
+	}
+	if got.cursor != 0 {
+		t.Fatalf("cursor=%d want 0", got.cursor)
+	}
+}
+
 func TestOutputScreenReturnsToPreviousScreen(t *testing.T) {
 	t.Parallel()
 
@@ -255,54 +257,55 @@ func TestOutputScreenReturnsToPreviousScreen(t *testing.T) {
 	}
 }
 
-func TestAcceptanceConfirmFlow(t *testing.T) {
+func TestHealthCheckGPUOpensNvidiaSATSetup(t *testing.T) {
 	t.Parallel()
 
 	m := newTestModel()
-	m.screen = screenAcceptance
-	m.cursor = 0
+	m.screen = screenHealthCheck
+	m.hcInitialized = true
+	m.hcSel = [4]bool{true, true, true, true}
 
-	next, cmd := m.handleAcceptanceMenu()
+	next, cmd := m.hcRunSingle(hcGPU)
 	got := next.(model)
 
-	if cmd != nil {
-		t.Fatal("expected nil cmd")
+	if cmd == nil {
+		t.Fatal("expected non-nil cmd (GPU list loader)")
 	}
-	if got.screen != screenConfirm {
-		t.Fatalf("screen=%q want %q", got.screen, screenConfirm)
-	}
-	if got.pendingAction != actionRunNvidiaSAT {
-		t.Fatalf("pendingAction=%q want %q", got.pendingAction, actionRunNvidiaSAT)
+	if got.screen != screenNvidiaSATSetup {
+		t.Fatalf("screen=%q want %q", got.screen, screenNvidiaSATSetup)
 	}
 
-	next, _ = got.updateConfirm(tea.KeyMsg{Type: tea.KeyEsc})
+	// esc from setup returns to health check
+	next, _ = got.updateNvidiaSATSetup(tea.KeyMsg{Type: tea.KeyEsc})
 	got = next.(model)
-	if got.screen != screenAcceptance {
-		t.Fatalf("screen after esc=%q want %q", got.screen, screenAcceptance)
+	if got.screen != screenHealthCheck {
+		t.Fatalf("screen after esc=%q want %q", got.screen, screenHealthCheck)
 	}
 }
 
-func TestAcceptanceMenuMapsNewTargets(t *testing.T) {
+func TestHealthCheckRunSingleMapsActions(t *testing.T) {
 	t.Parallel()
 
 	tests := []struct {
-		cursor int
-		want   actionKind
+		idx  int
+		want actionKind
 	}{
-		{cursor: 0, want: actionRunNvidiaSAT},
-		{cursor: 1, want: actionRunMemorySAT},
-		{cursor: 2, want: actionRunStorageSAT},
+		{idx: hcMemory, want: actionRunMemorySAT},
+		{idx: hcStorage, want: actionRunStorageSAT},
 	}
 
 	for _, test := range tests {
 		m := newTestModel()
-		m.screen = screenAcceptance
-		m.cursor = test.cursor
+		m.screen = screenHealthCheck
+		m.hcInitialized = true
 
-		next, _ := m.handleAcceptanceMenu()
+		next, _ := m.hcRunSingle(test.idx)
 		got := next.(model)
 		if got.pendingAction != test.want {
-			t.Fatalf("cursor=%d pendingAction=%q want %q", test.cursor, got.pendingAction, test.want)
+			t.Fatalf("idx=%d pendingAction=%q want %q", test.idx, got.pendingAction, test.want)
+		}
+		if got.screen != screenConfirm {
+			t.Fatalf("idx=%d screen=%q want %q", test.idx, got.screen, screenConfirm)
 		}
 	}
 }
@@ -323,8 +326,8 @@ func TestExportTargetSelectionOpensConfirm(t *testing.T) {
 	if got.screen != screenConfirm {
 		t.Fatalf("screen=%q want %q", got.screen, screenConfirm)
 	}
-	if got.pendingAction != actionExportAudit {
-		t.Fatalf("pendingAction=%q want %q", got.pendingAction, actionExportAudit)
+	if got.pendingAction != actionExportBundle {
+		t.Fatalf("pendingAction=%q want %q", got.pendingAction, actionExportBundle)
 	}
 	if got.selectedTarget == nil || got.selectedTarget.Device != "/dev/sdb1" {
 		t.Fatalf("selectedTarget=%+v want /dev/sdb1", got.selectedTarget)
@@ -377,14 +380,24 @@ func TestConfirmCancelTarget(t *testing.T) {
 
 	m := newTestModel()
 
-	m.pendingAction = actionExportAudit
+	m.pendingAction = actionExportBundle
 	if got := m.confirmCancelTarget(); got != screenExportTargets {
 		t.Fatalf("export cancel target=%q want %q", got, screenExportTargets)
 	}
 
-	m.pendingAction = actionRunNvidiaSAT
-	if got := m.confirmCancelTarget(); got != screenAcceptance {
-		t.Fatalf("sat cancel target=%q want %q", got, screenAcceptance)
+	m.pendingAction = actionRunAll
+	if got := m.confirmCancelTarget(); got != screenHealthCheck {
+		t.Fatalf("run all cancel target=%q want %q", got, screenHealthCheck)
+	}
+
+	m.pendingAction = actionRunMemorySAT
+	if got := m.confirmCancelTarget(); got != screenHealthCheck {
+		t.Fatalf("memory sat cancel target=%q want %q", got, screenHealthCheck)
+	}
+
+	m.pendingAction = actionRunStorageSAT
+	if got := m.confirmCancelTarget(); got != screenHealthCheck {
+		t.Fatalf("storage sat cancel target=%q want %q", got, screenHealthCheck)
 	}
 
 	m.pendingAction = actionNone
@@ -393,28 +406,6 @@ func TestConfirmCancelTarget(t *testing.T) {
 	}
 }
 
-func TestViewMainMenuRendersSelectedItem(t *testing.T) {
-	t.Parallel()
-
-	m := newTestModel()
-	m.cursor = 1
-
-	view := m.View()
-
-	for _, want := range []string{
-		"bee",
-		"Select action",
-		"  Network",
-		"> Services",
-		"Acceptance tests",
-		"[↑/↓] move  [enter] select  [esc] back  [ctrl+c] quit",
-	} {
-		if !strings.Contains(view, want) {
-			t.Fatalf("view missing %q\nview:\n%s", want, view)
-		}
-	}
-}
-
 func TestViewBusyStateIsMinimal(t *testing.T) {
 	t.Parallel()
 
@@ -433,12 +424,12 @@ func TestViewBusyStateUsesBusyTitle(t *testing.T) {
 
 	m := newTestModel()
 	m.busy = true
-	m.busyTitle = "Export audit"
+	m.busyTitle = "Export support bundle"
 
 	view := m.View()
 
 	for _, want := range []string{
-		"Export audit",
+		"Export support bundle",
 		"Working...",
 		"[ctrl+c] quit",
 	} {
@@ -454,13 +445,13 @@ func TestViewOutputScreenRendersBodyAndBackHint(t *testing.T) {
 	m := newTestModel()
 	m.screen = screenOutput
 	m.title = "Run audit"
-	m.body = "audit output: /var/log/bee-audit.json\n"
+	m.body = "audit output: /appdata/bee/export/bee-audit.json\n"
 
 	view := m.View()
 
 	for _, want := range []string{
 		"Run audit",
-		"audit output: /var/log/bee-audit.json",
+		"audit output: /appdata/bee/export/bee-audit.json",
 		"[enter/esc] back  [ctrl+c] quit",
 	} {
 		if !strings.Contains(view, want) {
@@ -469,6 +460,55 @@ func TestViewOutputScreenRendersBodyAndBackHint(t *testing.T) {
 	}
 }
 
+func TestViewRendersBannerModuleAboveScreenBody(t *testing.T) {
+	t.Parallel()
+
+	m := newTestModel()
+	m.banner = "System: Demo Server\nIP: 10.0.0.10"
+	m.width = 60
+
+	view := m.View()
+
+	for _, want := range []string{
+		"┌ MOTD ",
+		"System: Demo Server",
+		"IP: 10.0.0.10",
+		"Health Check",
+		"Export support bundle",
+	} {
+		if !strings.Contains(view, want) {
+			t.Fatalf("view missing %q\nview:\n%s", want, view)
+		}
+	}
+}
+
+func TestSnapshotMsgUpdatesBannerAndPanel(t *testing.T) {
+	t.Parallel()
+
+	m := newTestModel()
+
+	next, cmd := m.Update(snapshotMsg{
+		banner: "System: Demo",
+		panel: app.HardwarePanelData{
+			Header: []string{"Demo header"},
+			Rows: []app.ComponentRow{
+				{Key: "CPU", Status: "PASS", Detail: "ok"},
+			},
+		},
+	})
+	got := next.(model)
+
+	if cmd != nil {
+		t.Fatal("expected nil cmd")
+	}
+	if got.banner != "System: Demo" {
+		t.Fatalf("banner=%q want %q", got.banner, "System: Demo")
+	}
+	if len(got.panel.Rows) != 1 || got.panel.Rows[0].Key != "CPU" {
+		t.Fatalf("panel rows=%+v", got.panel.Rows)
+	}
+}
+
 func TestViewExportTargetsRendersDeviceMetadata(t *testing.T) {
 	t.Parallel()
 
@@ -487,7 +527,7 @@ func TestViewExportTargetsRendersDeviceMetadata(t *testing.T) {
 	view := m.View()
 
 	for _, want := range []string{
-		"Export audit",
+		"Export support bundle",
 		"Select removable filesystem",
 		"> /dev/sdb1 [vfat 29G] label=BEEUSB mounted=/media/bee",
 	} {
@@ -530,14 +570,14 @@ func TestViewConfirmScreenMatchesPendingExport(t *testing.T) {
 
 	m := newTestModel()
 	m.screen = screenConfirm
-	m.pendingAction = actionExportAudit
+	m.pendingAction = actionExportBundle
 	m.selectedTarget = &platform.RemovableTarget{Device: "/dev/sdb1"}
 
 	view := m.View()
 
 	for _, want := range []string{
-		"Export audit",
-		"Copy latest audit JSON to /dev/sdb1?",
+		"Export support bundle",
+		"Copy support bundle to /dev/sdb1?",
 		"> Confirm",
 		"  Cancel",
 	} {
@@ -552,11 +592,11 @@ func TestResultMsgClearsBusyAndPendingAction(t *testing.T) {
 
 	m := newTestModel()
 	m.busy = true
-	m.busyTitle = "Export audit"
-	m.pendingAction = actionExportAudit
+	m.busyTitle = "Export support bundle"
+	m.pendingAction = actionExportBundle
 	m.screen = screenConfirm
 
-	next, _ := m.Update(resultMsg{title: "Export audit", body: "done", back: screenMain})
+	next, _ := m.Update(resultMsg{title: "Export support bundle", body: "done", back: screenMain})
 	got := next.(model)
 
 	if got.busy {
@@ -575,7 +615,7 @@ func TestResultMsgErrorWithoutBodyFormatsCleanly(t *testing.T) {
 
 	m := newTestModel()
 
-	next, _ := m.Update(resultMsg{title: "Export audit", err: assertErr("boom"), back: screenMain})
+	next, _ := m.Update(resultMsg{title: "Export support bundle", err: assertErr("boom"), back: screenMain})
 	got := next.(model)
 
 	if got.body != "ERROR: boom" {

audit/internal/tui/types.go

@@ -1,10 +1,12 @@
 package tui
 
 import (
+	"strings"
+	"time"
+
 	"bee/audit/internal/app"
 	"bee/audit/internal/platform"
 	"bee/audit/internal/runtimeenv"
-	"strings"
 
 	tea "github.com/charmbracelet/bubbletea"
 )
@@ -12,16 +14,19 @@ import (
 type screen string
 
 const (
-	screenMain          screen = "main"
-	screenNetwork       screen = "network"
-	screenInterfacePick screen = "interface_pick"
-	screenServices      screen = "services"
-	screenServiceAction screen = "service_action"
-	screenAcceptance    screen = "acceptance"
-	screenExportTargets screen = "export_targets"
-	screenOutput        screen = "output"
-	screenStaticForm    screen = "static_form"
-	screenConfirm       screen = "confirm"
+	screenMain             screen = "main"
+	screenHealthCheck      screen = "health_check"
+	screenSettings         screen = "settings"
+	screenNetwork          screen = "network"
+	screenInterfacePick    screen = "interface_pick"
+	screenServices         screen = "services"
+	screenServiceAction    screen = "service_action"
+	screenExportTargets    screen = "export_targets"
+	screenOutput           screen = "output"
+	screenStaticForm       screen = "static_form"
+	screenConfirm          screen = "confirm"
+	screenNvidiaSATSetup   screen = "nvidia_sat_setup"
+	screenNvidiaSATRunning screen = "nvidia_sat_running"
 )
 
 type actionKind string
@@ -30,27 +35,29 @@ const (
 	actionNone          actionKind = ""
 	actionDHCPOne       actionKind = "dhcp_one"
 	actionStaticIPv4    actionKind = "static_ipv4"
-	actionExportAudit   actionKind = "export_audit"
-	actionRunNvidiaSAT  actionKind = "run_nvidia_sat"
+	actionExportBundle  actionKind = "export_bundle"
+	actionRunAll        actionKind = "run_all"
 	actionRunMemorySAT  actionKind = "run_memory_sat"
 	actionRunStorageSAT actionKind = "run_storage_sat"
+	actionRunCPUSAT     actionKind = "run_cpu_sat"
+	actionRunAMDGPUSAT  actionKind = "run_amd_gpu_sat"
 )
 
 type model struct {
 	app         *app.App
 	runtimeMode runtimeenv.Mode
 
-	screen      screen
-	prevScreen  screen
-	cursor      int
-	busy        bool
-	busyTitle   string
-	title       string
-	body        string
-	banner      string
-	mainMenu    []string
-	networkMenu []string
-	serviceMenu []string
+	screen       screen
+	prevScreen   screen
+	cursor       int
+	busy         bool
+	busyTitle    string
+	title        string
+	body         string
+	mainMenu     []string
+	settingsMenu []string
+	networkMenu  []string
+	serviceMenu  []string
 
 	services        []string
 	interfaces      []platform.InterfaceInfo
@@ -62,6 +69,36 @@ type model struct {
 
 	formFields []formField
 	formIndex  int
+
+	// Hardware panel (right column)
+	panel       app.HardwarePanelData
+	panelFocus  bool
+	panelCursor int
+	banner      string
+
+	// Health Check screen
+	hcSel         [4]bool
+	hcMode        int
+	hcCursor      int
+	hcInitialized bool
+
+	// NVIDIA SAT setup
+	nvidiaGPUs      []platform.NvidiaGPU
+	nvidiaGPUSel    []bool
+	nvidiaDurIdx    int
+	nvidiaSATCursor int
+
+	// NVIDIA SAT running
+	nvidiaSATCancel  func()
+	nvidiaSATAborted bool
+
+	// SAT verbose progress (CPU / Memory / Storage / AMD GPU)
+	progressLines  []string
+	progressPrefix string
+	progressSince  time.Time
+
+	// Terminal size
+	width int
 }
 
 type formField struct {
@@ -85,15 +122,20 @@ func newModel(application *app.App, runtimeMode runtimeenv.Mode) model {
 		runtimeMode: runtimeMode,
 		screen:      screenMain,
 		mainMenu: []string{
+			"Health Check",
+			"Export support bundle",
+			"Settings",
+			"Exit",
+		},
+		settingsMenu: []string{
 			"Network",
 			"Services",
-			"Acceptance tests",
-			"Run audit",
-			"Export audit",
+			"Re-run audit",
+			"Run self-check",
+			"Runtime issues",
+			"Audit logs",
 			"Check tools",
-			"Show health summary",
-			"Show audit logs",
-			"Exit",
+			"Back",
 		},
 		networkMenu: []string{
 			"Show status",
@@ -113,7 +155,40 @@ func newModel(application *app.App, runtimeMode runtimeenv.Mode) model {
 }
 
 func (m model) Init() tea.Cmd {
-	return func() tea.Msg {
-		return bannerMsg{text: strings.TrimSpace(m.app.MainBanner())}
+	return m.refreshSnapshotCmd()
+}
+
+func (m model) confirmBody() (string, string) {
+	switch m.pendingAction {
+	case actionExportBundle:
+		if m.selectedTarget == nil {
+			return "Export support bundle", "No target selected"
+		}
+		return "Export support bundle", "Copy support bundle to " + m.selectedTarget.Device + "?"
+	case actionRunAll:
+		modes := []string{"Quick", "Standard", "Express"}
+		mode := modes[m.hcMode]
+		var sel []string
+		names := []string{"GPU", "Memory", "Storage", "CPU"}
+		for i, on := range m.hcSel {
+			if on {
+				sel = append(sel, names[i])
+			}
+		}
+		if len(sel) == 0 {
+			return "Health Check", "No components selected."
+		}
+		return "Health Check", "Run: " + strings.Join(sel, " + ") + "\nMode: " + mode
+	case actionRunMemorySAT:
+		return "Memory test", "Run memtester?"
+	case actionRunStorageSAT:
+		return "Storage test", "Run storage diagnostic pack?"
+	case actionRunCPUSAT:
+		modes := []string{"Quick (60s)", "Standard (300s)", "Express (900s)"}
+		return "CPU test", "Run stress-ng? Mode: " + modes[m.hcMode]
+	case actionRunAMDGPUSAT:
+		return "AMD GPU test", "Run AMD GPU diagnostic pack (rocm-smi)?"
+	default:
+		return "Confirm", "Proceed?"
 	}
 }

audit/internal/tui/update.go

@@ -9,19 +9,39 @@ import (
 
 func (m model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 	switch msg := msg.(type) {
+	case tea.WindowSizeMsg:
+		m.width = msg.Width
+		return m, nil
 	case tea.KeyMsg:
 		if m.busy {
-			switch msg.String() {
-			case "ctrl+c":
+			if msg.String() == "ctrl+c" {
 				return m, tea.Quit
-			default:
-				return m, nil
 			}
+			return m, nil
 		}
-		return m.updateKey(msg)
+		next, cmd := m.updateKey(msg)
+		nextModel := next.(model)
+		if shouldRefreshSnapshot(m, nextModel) {
+			return nextModel, tea.Batch(cmd, nextModel.refreshSnapshotCmd())
+		}
+		return nextModel, cmd
+	case satProgressMsg:
+		if m.busy && m.progressPrefix != "" {
+			if len(msg.lines) > 0 {
+				m.progressLines = msg.lines
+			}
+			return m, pollSATProgress(m.progressPrefix, m.progressSince)
+		}
+		return m, nil
+	case snapshotMsg:
+		m.banner = msg.banner
+		m.panel = msg.panel
+		return m, nil
 	case resultMsg:
 		m.busy = false
 		m.busyTitle = ""
+		m.progressLines = nil
+		m.progressPrefix = ""
 		m.title = msg.title
 		if msg.err != nil {
 			body := strings.TrimSpace(msg.body)
@@ -41,35 +61,35 @@ func (m model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		}
 		m.screen = screenOutput
 		m.cursor = 0
-		return m, nil
+		return m, m.refreshSnapshotCmd()
 	case servicesMsg:
 		m.busy = false
 		m.busyTitle = ""
 		if msg.err != nil {
 			m.title = "Services"
 			m.body = msg.err.Error()
-			m.prevScreen = screenMain
+			m.prevScreen = screenSettings
 			m.screen = screenOutput
-			return m, nil
+			return m, m.refreshSnapshotCmd()
 		}
 		m.services = msg.services
 		m.screen = screenServices
 		m.cursor = 0
-		return m, nil
+		return m, m.refreshSnapshotCmd()
 	case interfacesMsg:
 		m.busy = false
 		m.busyTitle = ""
 		if msg.err != nil {
 			m.title = "interfaces"
 			m.body = msg.err.Error()
-			m.prevScreen = screenMain
+			m.prevScreen = screenNetwork
 			m.screen = screenOutput
-			return m, nil
+			return m, m.refreshSnapshotCmd()
 		}
 		m.interfaces = msg.ifaces
 		m.screen = screenInterfacePick
 		m.cursor = 0
-		return m, nil
+		return m, m.refreshSnapshotCmd()
 	case exportTargetsMsg:
 		m.busy = false
 		m.busyTitle = ""
@@ -78,32 +98,60 @@ func (m model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 			m.body = msg.err.Error()
 			m.prevScreen = screenMain
 			m.screen = screenOutput
-			return m, nil
+			return m, m.refreshSnapshotCmd()
 		}
 		m.targets = msg.targets
 		m.screen = screenExportTargets
 		m.cursor = 0
+		return m, m.refreshSnapshotCmd()
+	case nvidiaGPUsMsg:
+		return m.handleNvidiaGPUsMsg(msg)
+	case nvtopClosedMsg:
 		return m, nil
-	case bannerMsg:
-		m.banner = strings.TrimSpace(msg.text)
-		return m, nil
+	case nvidiaSATDoneMsg:
+		if m.nvidiaSATAborted {
+			return m, nil
+		}
+		if m.nvidiaSATCancel != nil {
+			m.nvidiaSATCancel()
+			m.nvidiaSATCancel = nil
+		}
+		m.prevScreen = screenHealthCheck
+		m.screen = screenOutput
+		m.title = msg.title
+		if msg.err != nil {
+			body := strings.TrimSpace(msg.body)
+			if body == "" {
+				m.body = fmt.Sprintf("ERROR: %v", msg.err)
+			} else {
+				m.body = fmt.Sprintf("%s\n\nERROR: %v", body, msg.err)
+			}
+		} else {
+			m.body = msg.body
+		}
+		return m, m.refreshSnapshotCmd()
 	}
-
 	return m, nil
 }
 
 func (m model) updateKey(msg tea.KeyMsg) (tea.Model, tea.Cmd) {
 	switch m.screen {
 	case screenMain:
-		return m.updateMenu(msg, len(m.mainMenu), m.handleMainMenu)
+		return m.updateMain(msg)
+	case screenHealthCheck:
+		return m.updateHealthCheck(msg)
+	case screenSettings:
+		return m.updateMenu(msg, len(m.settingsMenu), m.handleSettingsMenu)
 	case screenNetwork:
 		return m.updateMenu(msg, len(m.networkMenu), m.handleNetworkMenu)
 	case screenServices:
 		return m.updateMenu(msg, len(m.services), m.handleServicesMenu)
 	case screenServiceAction:
 		return m.updateMenu(msg, len(m.serviceMenu), m.handleServiceActionMenu)
-	case screenAcceptance:
-		return m.updateMenu(msg, 4, m.handleAcceptanceMenu)
+	case screenNvidiaSATSetup:
+		return m.updateNvidiaSATSetup(msg)
+	case screenNvidiaSATRunning:
+		return m.updateNvidiaSATRunning(msg)
 	case screenExportTargets:
 		return m.updateMenu(msg, len(m.targets), m.handleExportTargetsMenu)
 	case screenInterfacePick:
@@ -124,13 +172,54 @@ func (m model) updateKey(msg tea.KeyMsg) (tea.Model, tea.Cmd) {
 	case screenConfirm:
 		return m.updateConfirm(msg)
 	}
-
 	if msg.String() == "ctrl+c" {
 		return m, tea.Quit
 	}
 	return m, nil
 }
 
+// updateMain handles keys on the main (two-column) screen.
+func (m model) updateMain(msg tea.KeyMsg) (tea.Model, tea.Cmd) {
+	if m.panelFocus {
+		return m.updateMainPanel(msg)
+	}
+	// Switch focus to right panel.
+	if (msg.String() == "tab" || msg.String() == "right" || msg.String() == "l") && len(m.panel.Rows) > 0 {
+		m.panelFocus = true
+		return m, nil
+	}
+	return m.updateMenu(msg, len(m.mainMenu), m.handleMainMenu)
+}
+
+// updateMainPanel handles keys when right panel has focus.
+func (m model) updateMainPanel(msg tea.KeyMsg) (tea.Model, tea.Cmd) {
+	switch msg.String() {
+	case "up", "k":
+		if m.panelCursor > 0 {
+			m.panelCursor--
+		}
+	case "down", "j":
+		if m.panelCursor < len(m.panel.Rows)-1 {
+			m.panelCursor++
+		}
+	case "enter":
+		if m.panelCursor < len(m.panel.Rows) {
+			key := m.panel.Rows[m.panelCursor].Key
+			m.busy = true
+			m.busyTitle = key
+			return m, func() tea.Msg {
+				r := m.app.ComponentDetailResult(key)
+				return resultMsg{title: r.Title, body: r.Body, back: screenMain}
+			}
+		}
+	case "tab", "left", "h", "esc":
+		m.panelFocus = false
+	case "q", "ctrl+c":
+		return m, tea.Quit
+	}
+	return m, nil
+}
+
 func (m model) updateMenu(msg tea.KeyMsg, size int, onEnter func() (tea.Model, tea.Cmd)) (tea.Model, tea.Cmd) {
 	if size == 0 {
 		size = 1
@@ -148,7 +237,10 @@ func (m model) updateMenu(msg tea.KeyMsg, size int, onEnter func() (tea.Model, t
 		return onEnter()
 	case "esc":
 		switch m.screen {
-		case screenNetwork, screenServices, screenAcceptance:
+		case screenNetwork, screenServices:
+			m.screen = screenSettings
+			m.cursor = 0
+		case screenSettings:
 			m.screen = screenMain
 			m.cursor = 0
 		case screenServiceAction:

audit/internal/tui/view.go

@@ -7,61 +7,153 @@ import (
 	"bee/audit/internal/platform"
 
 	tea "github.com/charmbracelet/bubbletea"
+	"github.com/charmbracelet/lipgloss"
 )
 
+// Column widths for two-column main layout.
+const leftColWidth = 30
+
+var (
+	stylePass   = lipgloss.NewStyle().Foreground(lipgloss.Color("10")) // bright green
+	styleFail   = lipgloss.NewStyle().Foreground(lipgloss.Color("9"))  // bright red
+	styleCancel = lipgloss.NewStyle().Foreground(lipgloss.Color("11")) // bright yellow
+	styleNA     = lipgloss.NewStyle().Foreground(lipgloss.Color("8"))  // dark gray
+)
+
+func colorStatus(status string) string {
+	switch status {
+	case "PASS":
+		return stylePass.Render("PASS")
+	case "FAIL":
+		return styleFail.Render("FAIL")
+	case "CANCEL":
+		return styleCancel.Render("CANC")
+	default:
+		return styleNA.Render("N/A ")
+	}
+}
+
 func (m model) View() string {
+	var body string
 	if m.busy {
 		title := "bee"
 		if m.busyTitle != "" {
 			title = m.busyTitle
 		}
-		return fmt.Sprintf("%s\n\nWorking...\n\n[ctrl+c] quit\n", title)
-	}
-	switch m.screen {
-	case screenMain:
-		return renderMainMenu("bee", m.banner, "Select action", m.mainMenu, m.cursor)
-	case screenNetwork:
-		return renderMenu("Network", "Select action", m.networkMenu, m.cursor)
-	case screenServices:
-		return renderMenu("Services", "Select service", m.services, m.cursor)
-	case screenServiceAction:
-		items := make([]string, len(m.serviceMenu))
-		copy(items, m.serviceMenu)
-		return renderMenu("Service: "+m.selectedService, "Select action", items, m.cursor)
-	case screenAcceptance:
-		return renderMenu("Acceptance tests", "Select action", []string{"Run NVIDIA command pack", "Run memory test", "Run storage diagnostic pack", "Back"}, m.cursor)
-	case screenExportTargets:
-		return renderMenu("Export audit", "Select removable filesystem", renderTargetItems(m.targets), m.cursor)
-	case screenInterfacePick:
-		return renderMenu("Interfaces", "Select interface", renderInterfaceItems(m.interfaces), m.cursor)
-	case screenStaticForm:
-		return renderForm("Static IPv4: "+m.selectedIface, m.formFields, m.formIndex)
-	case screenConfirm:
-		title, body := m.confirmBody()
-		return renderConfirm(title, body, m.cursor)
-	case screenOutput:
-		return fmt.Sprintf("%s\n\n%s\n\n[enter/esc] back  [ctrl+c] quit\n", m.title, strings.TrimSpace(m.body))
-	default:
-		return "bee\n"
+		if len(m.progressLines) > 0 {
+			var b strings.Builder
+			fmt.Fprintf(&b, "%s\n\n", title)
+			for _, l := range m.progressLines {
+				fmt.Fprintf(&b, "  %s\n", l)
+			}
+			b.WriteString("\n[ctrl+c] quit\n")
+			body = b.String()
+		} else {
+			body = fmt.Sprintf("%s\n\nWorking...\n\n[ctrl+c] quit\n", title)
+		}
+	} else {
+		switch m.screen {
+		case screenMain:
+			body = renderTwoColumnMain(m)
+		case screenHealthCheck:
+			body = renderHealthCheck(m)
+		case screenSettings:
+			body = renderMenu("Settings", "Select action", m.settingsMenu, m.cursor)
+		case screenNetwork:
+			body = renderMenu("Network", "Select action", m.networkMenu, m.cursor)
+		case screenServices:
+			body = renderMenu("Services", "Select service", m.services, m.cursor)
+		case screenServiceAction:
+			body = renderMenu("Service: "+m.selectedService, "Select action", m.serviceMenu, m.cursor)
+		case screenExportTargets:
+			body = renderMenu("Export support bundle", "Select removable filesystem", renderTargetItems(m.targets), m.cursor)
+		case screenInterfacePick:
+			body = renderMenu("Interfaces", "Select interface", renderInterfaceItems(m.interfaces), m.cursor)
+		case screenStaticForm:
+			body = renderForm("Static IPv4: "+m.selectedIface, m.formFields, m.formIndex)
+		case screenConfirm:
+			title, confirmBody := m.confirmBody()
+			body = renderConfirm(title, confirmBody, m.cursor)
+		case screenNvidiaSATSetup:
+			body = renderNvidiaSATSetup(m)
+		case screenNvidiaSATRunning:
+			body = renderNvidiaSATRunning()
+		case screenOutput:
+			body = fmt.Sprintf("%s\n\n%s\n\n[enter/esc] back  [ctrl+c] quit\n", m.title, strings.TrimSpace(m.body))
+		default:
+			body = "bee\n"
+		}
 	}
+	return m.renderWithBanner(body)
 }
 
-func (m model) confirmBody() (string, string) {
-	switch m.pendingAction {
-	case actionExportAudit:
-		if m.selectedTarget == nil {
-			return "Export audit", "No target selected"
+// renderTwoColumnMain renders the main screen with menu on the left and hardware panel on the right.
+func renderTwoColumnMain(m model) string {
+	// Left column lines
+	leftLines := []string{"bee", ""}
+	for i, item := range m.mainMenu {
+		pfx := "  "
+		if !m.panelFocus && m.cursor == i {
+			pfx = "> "
 		}
-		return "Export audit", fmt.Sprintf("Copy latest audit JSON to %s?", m.selectedTarget.Device)
-	case actionRunNvidiaSAT:
-		return "NVIDIA SAT", "Run NVIDIA acceptance command pack?"
-	case actionRunMemorySAT:
-		return "Memory SAT", "Run runtime memory test with memtester?"
-	case actionRunStorageSAT:
-		return "Storage SAT", "Run storage diagnostic pack and start short self-tests where supported?"
-	default:
-		return "Confirm", "Proceed?"
+		leftLines = append(leftLines, pfx+item)
 	}
+
+	// Right column lines
+	rightLines := buildPanelLines(m)
+
+	// Render side by side
+	var b strings.Builder
+	maxRows := max(len(leftLines), len(rightLines))
+	for i := 0; i < maxRows; i++ {
+		l := ""
+		if i < len(leftLines) {
+			l = leftLines[i]
+		}
+		r := ""
+		if i < len(rightLines) {
+			r = rightLines[i]
+		}
+		w := lipgloss.Width(l)
+		if w < leftColWidth {
+			l += strings.Repeat(" ", leftColWidth-w)
+		}
+		b.WriteString(l + " │ " + r + "\n")
+	}
+
+	sep := strings.Repeat("─", leftColWidth) + "─┴─" + strings.Repeat("─", 46)
+	b.WriteString(sep + "\n")
+
+	if m.panelFocus {
+		b.WriteString("[↑↓] move  [enter] details  [tab/←] menu  [ctrl+c] quit\n")
+	} else {
+		b.WriteString("[↑↓] move  [enter] select  [tab/→] panel  [ctrl+c] quit\n")
+	}
+
+	return b.String()
+}
+
+func buildPanelLines(m model) []string {
+	p := m.panel
+	var lines []string
+
+	for _, h := range p.Header {
+		lines = append(lines, h)
+	}
+	if len(p.Header) > 0 && len(p.Rows) > 0 {
+		lines = append(lines, "")
+	}
+
+	for i, row := range p.Rows {
+		pfx := "  "
+		if m.panelFocus && m.panelCursor == i {
+			pfx = "> "
+		}
+		status := colorStatus(row.Status)
+		lines = append(lines, fmt.Sprintf("%s%s  %-4s  %s", pfx, status, row.Key, row.Detail))
+	}
+
+	return lines
 }
 
 func renderTargetItems(targets []platform.RemovableTarget) []string {
@@ -109,30 +201,6 @@ func renderMenu(title, subtitle string, items []string, cursor int) string {
 	return body.String()
 }
 
-func renderMainMenu(title, banner, subtitle string, items []string, cursor int) string {
-	var body strings.Builder
-	fmt.Fprintf(&body, "%s\n\n", title)
-	if banner != "" {
-		body.WriteString(strings.TrimSpace(banner))
-		body.WriteString("\n\n")
-	}
-	body.WriteString(subtitle)
-	body.WriteString("\n\n")
-	if len(items) == 0 {
-		body.WriteString("(no items)\n")
-	} else {
-		for i, item := range items {
-			prefix := "  "
-			if i == cursor {
-				prefix = "> "
-			}
-			fmt.Fprintf(&body, "%s%s\n", prefix, item)
-		}
-	}
-	body.WriteString("\n[↑/↓] move  [enter] select  [esc] back  [ctrl+c] quit\n")
-	return body.String()
-}
-
 func renderForm(title string, fields []formField, idx int) string {
 	var body strings.Builder
 	fmt.Fprintf(&body, "%s\n\n", title)
@@ -167,3 +235,60 @@ func resultCmd(title, body string, err error, back screen) tea.Cmd {
 		return resultMsg{title: title, body: body, err: err, back: back}
 	}
 }
+
+func (m model) renderWithBanner(body string) string {
+	body = strings.TrimRight(body, "\n")
+	banner := renderBannerModule(m.banner, m.width)
+	if banner == "" {
+		if body == "" {
+			return ""
+		}
+		return body + "\n"
+	}
+	if body == "" {
+		return banner + "\n"
+	}
+	return banner + "\n\n" + body + "\n"
+}
+
+func renderBannerModule(banner string, width int) string {
+	banner = strings.TrimSpace(banner)
+	if banner == "" {
+		return ""
+	}
+
+	lines := strings.Split(banner, "\n")
+	contentWidth := 0
+	for _, line := range lines {
+		if w := lipgloss.Width(line); w > contentWidth {
+			contentWidth = w
+		}
+	}
+	if width > 0 && width-4 > contentWidth {
+		contentWidth = width - 4
+	}
+	if contentWidth < 20 {
+		contentWidth = 20
+	}
+
+	label := " MOTD "
+	topFill := contentWidth + 2 - lipgloss.Width(label)
+	if topFill < 0 {
+		topFill = 0
+	}
+
+	var b strings.Builder
+	b.WriteString("┌" + label + strings.Repeat("─", topFill) + "┐\n")
+	for _, line := range lines {
+		b.WriteString("│ " + padRight(line, contentWidth) + " │\n")
+	}
+	b.WriteString("└" + strings.Repeat("─", contentWidth+2) + "┘")
+	return b.String()
+}
+
+func padRight(value string, width int) string {
+	if gap := width - lipgloss.Width(value); gap > 0 {
+		return value + strings.Repeat(" ", gap)
+	}
+	return value
+}

audit/internal/webui/server.go

@@ -0,0 +1,240 @@
+package webui
+
+import (
+	"errors"
+	"fmt"
+	"html"
+	"net/http"
+	"net/url"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+
+	"bee/audit/internal/app"
+	"reanimator/chart/viewer"
+	chartweb "reanimator/chart/web"
+)
+
+const defaultTitle = "Bee Hardware Audit"
+
+type HandlerOptions struct {
+	Title     string
+	AuditPath string
+	ExportDir string
+}
+
+func NewHandler(opts HandlerOptions) http.Handler {
+	title := strings.TrimSpace(opts.Title)
+	if title == "" {
+		title = defaultTitle
+	}
+
+	auditPath := strings.TrimSpace(opts.AuditPath)
+	exportDir := strings.TrimSpace(opts.ExportDir)
+	if exportDir == "" {
+		exportDir = app.DefaultExportDir
+	}
+	mux := http.NewServeMux()
+	mux.Handle("GET /static/", http.StripPrefix("/static/", chartweb.Static()))
+	mux.HandleFunc("GET /healthz", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Cache-Control", "no-store")
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte("ok"))
+	})
+	mux.HandleFunc("GET /audit.json", func(w http.ResponseWriter, r *http.Request) {
+		data, err := loadSnapshot(auditPath)
+		if err != nil {
+			if errors.Is(err, os.ErrNotExist) {
+				http.Error(w, "audit snapshot not found", http.StatusNotFound)
+				return
+			}
+			http.Error(w, fmt.Sprintf("read audit snapshot: %v", err), http.StatusInternalServerError)
+			return
+		}
+		w.Header().Set("Cache-Control", "no-store")
+		w.Header().Set("Content-Type", "application/json; charset=utf-8")
+		_, _ = w.Write(data)
+	})
+	mux.HandleFunc("GET /export/support.tar.gz", func(w http.ResponseWriter, r *http.Request) {
+		archive, err := app.BuildSupportBundle(exportDir)
+		if err != nil {
+			http.Error(w, fmt.Sprintf("build support bundle: %v", err), http.StatusInternalServerError)
+			return
+		}
+		w.Header().Set("Cache-Control", "no-store")
+		w.Header().Set("Content-Type", "application/gzip")
+		w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=%q", filepath.Base(archive)))
+		http.ServeFile(w, r, archive)
+	})
+	mux.HandleFunc("GET /runtime-health.json", func(w http.ResponseWriter, r *http.Request) {
+		data, err := loadSnapshot(filepath.Join(exportDir, "runtime-health.json"))
+		if err != nil {
+			if errors.Is(err, os.ErrNotExist) {
+				http.Error(w, "runtime health not found", http.StatusNotFound)
+				return
+			}
+			http.Error(w, fmt.Sprintf("read runtime health: %v", err), http.StatusInternalServerError)
+			return
+		}
+		w.Header().Set("Cache-Control", "no-store")
+		w.Header().Set("Content-Type", "application/json; charset=utf-8")
+		_, _ = w.Write(data)
+	})
+	mux.HandleFunc("GET /export/", func(w http.ResponseWriter, r *http.Request) {
+		body, err := renderExportIndex(exportDir)
+		if err != nil {
+			http.Error(w, fmt.Sprintf("render export index: %v", err), http.StatusInternalServerError)
+			return
+		}
+		w.Header().Set("Cache-Control", "no-store")
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		_, _ = w.Write([]byte(body))
+	})
+	mux.HandleFunc("GET /export/file", func(w http.ResponseWriter, r *http.Request) {
+		rel := strings.TrimSpace(r.URL.Query().Get("path"))
+		if rel == "" {
+			http.Error(w, "path is required", http.StatusBadRequest)
+			return
+		}
+		clean := filepath.Clean(rel)
+		if clean == "." || strings.HasPrefix(clean, "..") {
+			http.Error(w, "invalid path", http.StatusBadRequest)
+			return
+		}
+		http.ServeFile(w, r, filepath.Join(exportDir, clean))
+	})
+	mux.HandleFunc("GET /viewer", func(w http.ResponseWriter, r *http.Request) {
+		snapshot, err := loadSnapshot(auditPath)
+		if err != nil && !errors.Is(err, os.ErrNotExist) {
+			http.Error(w, fmt.Sprintf("read audit snapshot: %v", err), http.StatusInternalServerError)
+			return
+		}
+		html, err := viewer.RenderHTML(snapshot, title)
+		if err != nil {
+			http.Error(w, fmt.Sprintf("render snapshot: %v", err), http.StatusInternalServerError)
+			return
+		}
+		w.Header().Set("Cache-Control", "no-store")
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		_, _ = w.Write(html)
+	})
+	mux.HandleFunc("GET /", func(w http.ResponseWriter, r *http.Request) {
+		noticeTitle, noticeBody := runtimeNotice(filepath.Join(exportDir, "runtime-health.json"))
+		body := renderShellPage(title, noticeTitle, noticeBody)
+		w.Header().Set("Cache-Control", "no-store")
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		_, _ = w.Write([]byte(body))
+	})
+	return mux
+}
+
+func ListenAndServe(addr string, opts HandlerOptions) error {
+	return http.ListenAndServe(addr, NewHandler(opts))
+}
+
+func loadSnapshot(path string) ([]byte, error) {
+	if strings.TrimSpace(path) == "" {
+		return nil, os.ErrNotExist
+	}
+	return os.ReadFile(path)
+}
+
+func runtimeNotice(path string) (string, string) {
+	health, err := app.ReadRuntimeHealth(path)
+	if err != nil {
+		return "Runtime Health", "No runtime health snapshot found yet."
+	}
+	body := fmt.Sprintf("Status: %s. Export dir: %s. Driver ready: %t. CUDA ready: %t. Network: %s. Export files: /export/",
+		firstNonEmpty(health.Status, "UNKNOWN"),
+		firstNonEmpty(health.ExportDir, app.DefaultExportDir),
+		health.DriverReady,
+		health.CUDAReady,
+		firstNonEmpty(health.NetworkStatus, "UNKNOWN"),
+	)
+	if len(health.Issues) > 0 {
+		body += " Issues: "
+		parts := make([]string, 0, len(health.Issues))
+		for _, issue := range health.Issues {
+			parts = append(parts, issue.Code)
+		}
+		body += strings.Join(parts, ", ")
+	}
+	return "Runtime Health", body
+}
+
+func renderExportIndex(exportDir string) (string, error) {
+	var entries []string
+	err := filepath.Walk(strings.TrimSpace(exportDir), func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+		if info.IsDir() {
+			return nil
+		}
+		rel, err := filepath.Rel(exportDir, path)
+		if err != nil {
+			return err
+		}
+		entries = append(entries, rel)
+		return nil
+	})
+	if err != nil && !errors.Is(err, os.ErrNotExist) {
+		return "", err
+	}
+	sort.Strings(entries)
+	var body strings.Builder
+	body.WriteString("<!DOCTYPE html><html><head><meta charset=\"utf-8\"><title>Bee Export Files</title></head><body>")
+	body.WriteString("<h1>Bee Export Files</h1><ul>")
+	for _, entry := range entries {
+		body.WriteString("<li><a href=\"/export/file?path=" + url.QueryEscape(entry) + "\">" + html.EscapeString(entry) + "</a></li>")
+	}
+	if len(entries) == 0 {
+		body.WriteString("<li>No export files found.</li>")
+	}
+	body.WriteString("</ul></body></html>")
+	return body.String(), nil
+}
+
+func renderShellPage(title, noticeTitle, noticeBody string) string {
+	var body strings.Builder
+	body.WriteString("<!DOCTYPE html><html><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">")
+	body.WriteString("<title>" + html.EscapeString(title) + "</title>")
+	body.WriteString(`<style>
+body{margin:0;font-family:system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif;background:#f4f1ea;color:#1b1b18}
+.shell{min-height:100vh;display:grid;grid-template-rows:auto auto 1fr}
+.header{padding:18px 20px 12px;border-bottom:1px solid rgba(0,0,0,.08);background:#fbf8f2}
+.header h1{margin:0;font-size:24px}
+.header p{margin:6px 0 0;color:#5a5a52}
+.actions{display:flex;flex-wrap:wrap;gap:10px;padding:12px 20px;background:#fbf8f2}
+.actions a{display:inline-block;text-decoration:none;padding:10px 14px;border-radius:999px;background:#1f5f4a;color:#fff;font-weight:600}
+.actions a.secondary{background:#d8e5dd;color:#17372b}
+.notice{margin:16px 20px 0;padding:14px 16px;border-radius:14px;background:#fff7df;border:1px solid #ead9a4}
+.notice h2{margin:0 0 6px;font-size:16px}
+.notice p{margin:0;color:#4f4a37}
+.viewer-wrap{padding:16px 20px 20px}
+.viewer{width:100%;height:calc(100vh - 170px);border:0;border-radius:18px;background:#fff;box-shadow:0 12px 40px rgba(0,0,0,.08)}
+@media (max-width:720px){.viewer{height:calc(100vh - 240px)}}
+</style></head><body><div class="shell">`)
+	body.WriteString("<header class=\"header\"><h1>" + html.EscapeString(title) + "</h1><p>Audit viewer with support bundle and raw export access.</p></header>")
+	body.WriteString("<nav class=\"actions\">")
+	body.WriteString("<a href=\"/export/support.tar.gz\">Download support bundle</a>")
+	body.WriteString("<a class=\"secondary\" href=\"/audit.json\">Open audit.json</a>")
+	body.WriteString("<a class=\"secondary\" href=\"/runtime-health.json\">Open runtime-health.json</a>")
+	body.WriteString("<a class=\"secondary\" href=\"/export/\">Browse export files</a>")
+	body.WriteString("</nav>")
+	if strings.TrimSpace(noticeTitle) != "" {
+		body.WriteString("<section class=\"notice\"><h2>" + html.EscapeString(noticeTitle) + "</h2><p>" + html.EscapeString(noticeBody) + "</p></section>")
+	}
+	body.WriteString("<main class=\"viewer-wrap\"><iframe class=\"viewer\" src=\"/viewer\" loading=\"eager\" referrerpolicy=\"same-origin\"></iframe></main>")
+	body.WriteString("</div></body></html>")
+	return body.String()
+}
+
+func firstNonEmpty(value, fallback string) string {
+	value = strings.TrimSpace(value)
+	if value == "" {
+		return fallback
+	}
+	return value
+}

audit/internal/webui/server_test.go

@@ -0,0 +1,167 @@
+package webui
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestRootRendersShellWithIframe(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "audit.json")
+	exportDir := filepath.Join(dir, "export")
+	if err := os.MkdirAll(exportDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(path, []byte(`{"collected_at":"2026-03-15T00:00:00Z","hardware":{"board":{"serial_number":"SERIAL-OLD"}}}`), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	handler := NewHandler(HandlerOptions{
+		Title:     "Bee Hardware Audit",
+		AuditPath: path,
+		ExportDir: exportDir,
+	})
+
+	first := httptest.NewRecorder()
+	handler.ServeHTTP(first, httptest.NewRequest(http.MethodGet, "/", nil))
+	if first.Code != http.StatusOK {
+		t.Fatalf("first status=%d", first.Code)
+	}
+	if !strings.Contains(first.Body.String(), `iframe`) || !strings.Contains(first.Body.String(), `src="/viewer"`) {
+		t.Fatalf("first body missing iframe viewer: %s", first.Body.String())
+	}
+	if !strings.Contains(first.Body.String(), "/export/support.tar.gz") {
+		t.Fatalf("first body missing support bundle link: %s", first.Body.String())
+	}
+	if got := first.Header().Get("Cache-Control"); got != "no-store" {
+		t.Fatalf("first cache-control=%q", got)
+	}
+
+	if err := os.WriteFile(path, []byte(`{"collected_at":"2026-03-15T00:05:00Z","hardware":{"board":{"serial_number":"SERIAL-NEW"}}}`), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	second := httptest.NewRecorder()
+	handler.ServeHTTP(second, httptest.NewRequest(http.MethodGet, "/", nil))
+	if second.Code != http.StatusOK {
+		t.Fatalf("second status=%d", second.Code)
+	}
+	if !strings.Contains(second.Body.String(), `src="/viewer"`) {
+		t.Fatalf("second body missing iframe viewer: %s", second.Body.String())
+	}
+}
+
+func TestViewerRendersLatestSnapshot(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "audit.json")
+	if err := os.WriteFile(path, []byte(`{"collected_at":"2026-03-15T00:00:00Z","hardware":{"board":{"serial_number":"SERIAL-OLD"}}}`), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	handler := NewHandler(HandlerOptions{AuditPath: path})
+	first := httptest.NewRecorder()
+	handler.ServeHTTP(first, httptest.NewRequest(http.MethodGet, "/viewer", nil))
+	if first.Code != http.StatusOK {
+		t.Fatalf("first status=%d", first.Code)
+	}
+	if !strings.Contains(first.Body.String(), "SERIAL-OLD") {
+		t.Fatalf("viewer body missing old serial: %s", first.Body.String())
+	}
+
+	if err := os.WriteFile(path, []byte(`{"collected_at":"2026-03-15T00:05:00Z","hardware":{"board":{"serial_number":"SERIAL-NEW"}}}`), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	second := httptest.NewRecorder()
+	handler.ServeHTTP(second, httptest.NewRequest(http.MethodGet, "/viewer", nil))
+	if second.Code != http.StatusOK {
+		t.Fatalf("second status=%d", second.Code)
+	}
+	if !strings.Contains(second.Body.String(), "SERIAL-NEW") {
+		t.Fatalf("viewer body missing new serial: %s", second.Body.String())
+	}
+	if strings.Contains(second.Body.String(), "SERIAL-OLD") {
+		t.Fatalf("viewer body still contains old serial: %s", second.Body.String())
+	}
+}
+
+func TestAuditJSONServesLatestSnapshot(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "audit.json")
+	body := `{"hardware":{"board":{"serial_number":"SERIAL-API"}}}`
+	if err := os.WriteFile(path, []byte(body), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	handler := NewHandler(HandlerOptions{AuditPath: path})
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/audit.json", nil))
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status=%d", rec.Code)
+	}
+	if got := strings.TrimSpace(rec.Body.String()); got != body {
+		t.Fatalf("body=%q want %q", got, body)
+	}
+	if got := rec.Header().Get("Content-Type"); !strings.Contains(got, "application/json") {
+		t.Fatalf("content-type=%q", got)
+	}
+}
+
+func TestMissingAuditJSONReturnsNotFound(t *testing.T) {
+	handler := NewHandler(HandlerOptions{AuditPath: "/missing/audit.json"})
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/audit.json", nil))
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("status=%d want %d", rec.Code, http.StatusNotFound)
+	}
+}
+
+func TestSupportBundleEndpointReturnsArchive(t *testing.T) {
+	dir := t.TempDir()
+	exportDir := filepath.Join(dir, "export")
+	if err := os.MkdirAll(exportDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(exportDir, "bee-audit.log"), []byte("audit log"), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	handler := NewHandler(HandlerOptions{ExportDir: exportDir})
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/export/support.tar.gz", nil))
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s", rec.Code, rec.Body.String())
+	}
+	if got := rec.Header().Get("Content-Disposition"); !strings.Contains(got, "attachment;") {
+		t.Fatalf("content-disposition=%q", got)
+	}
+	if rec.Body.Len() == 0 {
+		t.Fatal("empty archive body")
+	}
+}
+
+func TestRuntimeHealthEndpointReturnsJSON(t *testing.T) {
+	dir := t.TempDir()
+	exportDir := filepath.Join(dir, "export")
+	if err := os.MkdirAll(exportDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+	body := `{"status":"PARTIAL","checked_at":"2026-03-16T10:00:00Z"}`
+	if err := os.WriteFile(filepath.Join(exportDir, "runtime-health.json"), []byte(body), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	handler := NewHandler(HandlerOptions{ExportDir: exportDir})
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/runtime-health.json", nil))
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s", rec.Code, rec.Body.String())
+	}
+	if strings.TrimSpace(rec.Body.String()) != body {
+		t.Fatalf("body=%q want %q", strings.TrimSpace(rec.Body.String()), body)
+	}
+}

bible-local/architecture/runtime-flows.md

@@ -18,8 +18,10 @@ local-fs.target
   ├── bee-network.service    (starts `dhclient -nw` on all physical interfaces, non-blocking)
   ├── bee-nvidia.service     (insmod nvidia*.ko from /usr/local/lib/nvidia/,
   │                           creates /dev/nvidia* nodes)
-  └── bee-audit.service      (runs `bee audit` → /var/log/bee-audit.json,
-                               never blocks boot on partial collector failures)
+  ├── bee-audit.service      (runs `bee audit` → /var/log/bee-audit.json,
+  │                            never blocks boot on partial collector failures)
+  └── bee-web.service        (runs `bee web` on :80,
+                               reads the latest audit snapshot on each request)
 ```
 
 **Critical invariants:**
@@ -29,6 +31,7 @@ local-fs.target
   Reason: the modules are shipped in the ISO overlay under `/usr/local/lib/nvidia/`, not in the host module tree.
 - `bee-audit.service` does not wait for `network-online.target`; audit is local and must run even if DHCP is broken.
 - `bee-audit.service` logs audit failures but does not turn partial collector problems into a boot blocker.
+- `bee-web.service` binds `0.0.0.0:80` and always renders the current `/var/log/bee-audit.json` contents.
 - Audit JSON now includes a `hardware.summary` block with overall verdict and warning/failure counts.
 
 ## Console and login flow
@@ -54,7 +57,7 @@ Rules:
 ## ISO build sequence
 
 ```
-build.sh [--authorized-keys /path/to/keys]
+build-in-container.sh [--authorized-keys /path/to/keys]
   1. compile `bee` binary (skip if .go files older than binary)
   2. create a temporary overlay staging dir under `dist/`
   3. inject authorized_keys into staged `root/.ssh/` (or set password fallback marker)
@@ -75,13 +78,12 @@ build.sh [--authorized-keys /path/to/keys]
   11. patch staged `motd` with build metadata
   12. copy `iso/builder/` into a temporary live-build workdir under `dist/`
   13. sync staged overlay into workdir `config/includes.chroot/`
-  14. run `lb config && lb build` inside the temporary workdir
-     (either on a Debian host/VM or inside the privileged builder container)
+  14. run `lb config && lb build` inside the privileged builder container
 ```
 
 **Critical invariants:**
 - `DEBIAN_KERNEL_ABI` in `iso/builder/VERSIONS` pins the exact kernel ABI used in BOTH places:
-  1. `setup-builder.sh` / `build-in-container.sh` / `build-nvidia-module.sh` — Debian kernel headers for module build
+  1. `build-in-container.sh` / `build-nvidia-module.sh` — Debian kernel headers for module build
   2. `auto/config` — `linux-image-${DEBIAN_KERNEL_ABI}` in the ISO
 - NVIDIA modules go to staged `usr/local/lib/nvidia/` — NOT to `/lib/modules/<kver>/extra/`.
 - The source overlay in `iso/overlay/` is treated as immutable source. Build-time files are injected only into the staged overlay.
@@ -138,3 +140,34 @@ Acceptance flows:
   - `BEE_GPU_STRESS_SIZE_MB`
   - `BEE_MEMTESTER_SIZE_MB`
   - `BEE_MEMTESTER_PASSES`
+
+## NVIDIA SAT TUI flow (v1.0.0+)
+
+```
+TUI: Acceptance tests → NVIDIA command pack
+  1. screenNvidiaSATSetup
+       a. enumerate GPUs via `nvidia-smi --query-gpu=index,name,memory.total`
+       b. user selects duration preset: 10 min / 1 h / 8 h / 24 h
+       c. user selects GPUs via checkboxes (all selected by default)
+       d. memory size = max(selected GPU memory) — auto-detected, not exposed to user
+  2. Start → screenNvidiaSATRunning
+       a. CUDA_VISIBLE_DEVICES set to selected GPU indices
+       b. tea.Batch: SAT goroutine + tea.ExecProcess(nvtop) launched concurrently
+       c. nvtop occupies full terminal; SAT result queues in background
+       d. [o] reopen nvtop at any time; [a] abort (cancels context → kills bee-gpu-stress)
+  3. GPU metrics collection (during bee-gpu-stress)
+       - background goroutine polls `nvidia-smi` every second
+       - per-second rows: elapsed, GPU index, temp°C, usage%, power W, clock MHz
+       - outputs: gpu-metrics.csv, gpu-metrics.html (offline SVG chart), gpu-metrics-term.txt
+  4. After SAT completes
+       - result shown in screenOutput with terminal line-chart (gpu-metrics-term.txt)
+       - chart is asciigraph-style: box-drawing chars (╭╮╰╯─│), 4 series per GPU,
+         Y axis with ticks, ANSI colours (red=temp, blue=usage, green=power, yellow=clock)
+```
+
+**Critical invariants:**
+- `nvtop` must be in `iso/builder/config/package-lists/bee.list.chroot` (baked into ISO).
+- `bee-gpu-stress` uses `exec.CommandContext` — aborted on cancel.
+- Metric goroutine uses stopCh/doneCh pattern; main goroutine waits `<-doneCh` before reading rows (no mutex needed).
+- If `nvtop` is not found on PATH, SAT still runs without it (graceful degradation).
+- SVG chart is fully offline: no JS, no external CSS, pure inline SVG.

bible-local/architecture/system-overview.md

@@ -26,6 +26,7 @@ Fills gaps where Redfish/logpile is blind:
 - NVIDIA proprietary driver loaded at boot for GPU enrichment via `nvidia-smi`
 - SSH access (OpenSSH) always available for inspection and debugging
 - Interactive Go TUI via `bee tui` for network setup, service management, and acceptance tests
+- Read-only web viewer via `bee web`, rendering the latest audit snapshot through the embedded Reanimator Chart
 - Local `tty1` operator UX: `bee` autologin, `menu` auto-start, privileged actions via `sudo -n`
 
 ## Network isolation — CRITICAL
@@ -95,6 +96,7 @@ Fills gaps where Redfish/logpile is blind:
 | `iso/builder/` | ISO build scripts and `live-build` profile |
 | `iso/overlay/` | Source overlay copied into a staged build overlay |
 | `iso/vendor/` | Optional pre-built vendor binaries (storcli64, sas2ircu, sas3ircu, arcconf, ssacli, …) |
+| `internal/chart/` | Git submodule with `reanimator/chart`, embedded into `bee web` |
 | `iso/builder/VERSIONS` | Pinned versions: Debian, Go, NVIDIA driver, kernel ABI |
 | `iso/builder/smoketest.sh` | Post-boot smoke test — run via SSH to verify live ISO |
 | `iso/overlay/etc/profile.d/bee.sh` | `menu` helper + tty1 auto-start policy |

bible-local/backlog.md

@@ -1,5 +1,26 @@
 # Backlog
 
+## BMC версия через IPMI
+
+**Статус:** реализовано.
+
+Добавить сбор версии BMC firmware в board collector:
+- Команда: `ipmitool mc info` → поле `Firmware Revision`
+- Записывать в `hardware.firmware[]` как `{device_name: "BMC", version: "..."}`
+- Показывать в TUI правой колонке рядом с BIOS версией
+- Graceful skip если `/dev/ipmi0` отсутствует (silent: same pattern as PSU collector)
+
+## CPU acceptance test через stress-ng
+
+**Статус:** реализовано. CPU в Health Check получает PASS/FAIL из summary.txt.
+
+Добавить CPU SAT на базе `stress-ng`:
+- Bake `stress-ng` в ISO (добавить в `bee.list.chroot`)
+- Новый `bee sat cpu` — запускает `stress-ng --cpu 0 --cpu-method all --timeout <N>` где N = duration из режима (Quick=60s, Standard=300s, Express=900s)
+- Параллельно снимает температуры через `sensors` и throttle-флаги из аудит JSON
+- Результат: SAT архив с summary.txt в формате других SAT (overall_status=OK/FAILED)
+- После реализации: CPU в Health Check получает реальный PASS/FAIL статус
+
 ## Real hardware validation
 
 **Статус:** ожидает доступа к железу.

bible-local/docs/hardware-ingest-contract.md

@@ -1,6 +1,6 @@
 ---
 title: Hardware Ingest JSON Contract
-version: "2.1"
+version: "2.7"
 updated: "2026-03-15"
 maintainer: Reanimator Core
 audience: external-integrators, ai-agents
@@ -9,7 +9,7 @@ language: ru
 
 # Интеграция с Reanimator: контракт JSON-импорта аппаратного обеспечения
 
-Версия: **2.1** · Дата: **2026-03-15**
+Версия: **2.7** · Дата: **2026-03-15**
 
 Документ описывает формат JSON для передачи данных об аппаратном обеспечении серверов в систему **Reanimator** (управление жизненным циклом аппаратного обеспечения).
 Предназначен для разработчиков смежных систем (Redfish-коллекторов, агентов мониторинга, CMDB-экспортёров) и может быть включён в документацию интегрируемых проектов.
@@ -22,6 +22,9 @@ language: ru
 
 | Версия | Дата | Изменения |
 |--------|------|-----------|
+| 2.7 | 2026-03-15 | Явно запрещён синтез данных в `event_logs`; интеграторы не должны придумывать серийные номера компонентов, если источник их не отдал |
+| 2.6 | 2026-03-15 | Добавлена необязательная секция `event_logs` для dedup/upsert логов `host` / `bmc` / `redfish` вне history timeline |
+| 2.5 | 2026-03-15 | Добавлено общее необязательное поле `manufactured_year_week` для компонентных секций (`YYYY-Www`) |
 | 2.4 | 2026-03-15 | Добавлена первая волна component telemetry: health/life поля для `cpus`, `memory`, `storage`, `pcie_devices`, `power_supplies` |
 | 2.3 | 2026-03-15 | Добавлены component telemetry поля: `pcie_devices.temperature_c`, `pcie_devices.power_w`, `power_supplies.temperature_c` |
 | 2.2 | 2026-03-15 | Добавлено поле `numa_node` у `pcie_devices` для topology/affinity |
@@ -38,6 +41,7 @@ language: ru
 3. **Частичность** — можно передавать только те секции, данные по которым доступны. Пустой массив и отсутствие секции эквивалентны.
 4. **Строгая схема** — endpoint использует строгий JSON-декодер; неизвестные поля приводят к `400 Bad Request`.
 5. **Event-driven** — импорт создаёт события в timeline (LOG_COLLECTED, INSTALLED, REMOVED, FIRMWARE_CHANGED и др.).
+6. **Без синтеза со стороны интегратора** — сборщик передаёт только фактически собранные значения. Нельзя придумывать `serial_number`, `component_ref`, `message`, `message_id` или другие идентификаторы/атрибуты, если источник их не предоставил или парсер не смог их надёжно извлечь.
 
 ---
 
@@ -127,7 +131,8 @@ GET /ingest/hardware/jobs/{job_id}
     "storage":        [ ... ],
     "pcie_devices":   [ ... ],
     "power_supplies": [ ... ],
-    "sensors":        { ... }
+    "sensors":        { ... },
+    "event_logs":     [ ... ]
   }
 }
 ```
@@ -157,6 +162,7 @@ GET /ingest/hardware/jobs/{job_id}
 | `status_changed_at` | string RFC3339 | Время последнего изменения статуса |
 | `status_history` | array | История переходов статусов (см. ниже) |
 | `error_description` | string | Текст ошибки/диагностики |
+| `manufactured_year_week` | string | Дата производства в формате `YYYY-Www`, например `2024-W07` |
 
 **Объект `status_history[]`:**
 
@@ -178,6 +184,7 @@ GET /ingest/hardware/jobs/{job_id}
 - Если источник хранит историю — передавайте `status_history` отсортированным по `changed_at` по возрастанию.
 - Не включайте записи `status_history` без `changed_at`.
 - Все даты — RFC3339, рекомендуется UTC (`Z`).
+- `manufactured_year_week` используйте, когда источник знает только год и неделю производства, без точной календарной даты.
 
 ---
 
@@ -250,12 +257,14 @@ GET /ingest/hardware/jobs/{job_id}
 | `life_remaining_pct` | float | нет | Остаточный ресурс / health, % |
 | `life_used_pct` | float | нет | Использованный ресурс / wear, % |
 | `serial_number` | string | нет | Серийный номер (если доступен) |
-| `firmware` | string | нет | Версия микрокода |
+| `firmware` | string | нет | Версия микрокода; если логгер отдает `Microcode level`, передавайте его сюда как есть |
 | `present` | bool | нет | Наличие (по умолчанию `true`) |
 | + общие поля статуса | | | см. раздел выше |
 
 **Генерация serial_number при отсутствии:** `{board_serial}-CPU-{socket}`
 
+Если источник использует поле/лейбл `Microcode level`, его значение передавайте в `cpus[].firmware` без дополнительного преобразования.
+
 ```json
 "cpus": [
   {
@@ -282,7 +291,6 @@ GET /ingest/hardware/jobs/{job_id}
 | Поле | Тип | Обязательно | Описание |
 |------|-----|-------------|----------|
 | `slot` | string | нет | Идентификатор слота |
-| `location` | string | нет | Физическое расположение |
 | `present` | bool | нет | Наличие модуля (по умолчанию `true`) |
 | `serial_number` | string | нет | Серийный номер |
 | `part_number` | string | нет | Партномер (используется как модель) |
@@ -328,7 +336,7 @@ GET /ingest/hardware/jobs/{job_id}
 
 | Поле | Тип | Обязательно | Описание |
 |------|-----|-------------|----------|
-| `slot` | string | нет | Идентификатор слота |
+| `slot` | string | нет | Канонический адрес установки PCIe-устройства; передавайте BDF (`0000:18:00.0`) |
 | `serial_number` | string | нет | Серийный номер |
 | `model` | string | нет | Модель |
 | `manufacturer` | string | нет | Производитель |
@@ -404,7 +412,7 @@ GET /ingest/hardware/jobs/{job_id}
 | `sfp_rx_power_dbm` | float | нет | RX optical power, dBm |
 | `sfp_voltage_v` | float | нет | Напряжение SFP, В |
 | `sfp_bias_ma` | float | нет | Bias current SFP, мА |
-| `bdf` | string | нет | Bus:Device.Function, например `0000:18:00.0` |
+| `bdf` | string | нет | Deprecated alias для `slot`; при наличии ingest нормализует его в `slot` |
 | `device_class` | string | нет | Класс устройства (см. список ниже) |
 | `manufacturer` | string | нет | Производитель |
 | `model` | string | нет | Модель |
@@ -421,7 +429,9 @@ GET /ingest/hardware/jobs/{job_id}
 `numa_node` передавайте для NIC / InfiniBand / RAID / GPU, когда источник знает CPU/NUMA affinity. Поле сохраняется в snapshot-атрибутах PCIe-компонента и дублируется в telemetry для topology use cases.
 Поля `temperature_c` и `power_w` используйте для device-level telemetry GPU / accelerator / smart PCIe devices. Они не влияют на идентификацию компонента.
 
-**Генерация serial_number при отсутствии или `"N/A"`:** `{board_serial}-PCIE-{slot}`
+**Генерация serial_number при отсутствии или `"N/A"`:** `{board_serial}-PCIE-{slot}`, где `slot` для PCIe равен BDF.
+
+`slot` — единственный канонический адрес компонента. Для PCIe в `slot` передавайте BDF. Поле `bdf` сохраняется только как переходный alias на входе и не должно использоваться как отдельная координата рядом со `slot`.
 
 **Значения `device_class`:**
 
@@ -441,7 +451,7 @@ GET /ingest/hardware/jobs/{job_id}
 ```json
 "pcie_devices": [
   {
-    "slot": "PCIeCard2",
+    "slot": "0000:3b:00.0",
     "vendor_id": 5555,
     "device_id": 4401,
     "numa_node": 0,
@@ -450,7 +460,6 @@ GET /ingest/hardware/jobs/{job_id}
     "sfp_temperature_c": 36.2,
     "sfp_tx_power_dbm": -1.8,
     "sfp_rx_power_dbm": -2.1,
-    "bdf": "0000:3b:00.0",
     "device_class": "EthernetController",
     "manufacturer": "Intel",
     "model": "X710 10GbE",
@@ -526,6 +535,58 @@ PSU без `serial_number` игнорируется.
 }
 ```
 
+---
+
+### event_logs
+
+Нормализованные операционные логи сервера из `host`, `bmc` или `redfish`.
+
+Эти записи не попадают в history timeline и не создают history events. Они сохраняются в отдельной deduplicated log store и отображаются в отдельном UI-блоке asset logs / host logs.
+
+| Поле | Тип | Обязательно | Описание |
+|------|-----|-------------|----------|
+| `source` | string | **да** | Источник лога: `host`, `bmc`, `redfish` |
+| `event_time` | string RFC3339 | нет | Время события из источника; если отсутствует, используется время ingest/collection |
+| `severity` | string | нет | Уровень: `OK`, `Info`, `Warning`, `Critical`, `Unknown` |
+| `message_id` | string | нет | Идентификатор/код события источника |
+| `message` | string | **да** | Нормализованный текст события |
+| `component_ref` | string | нет | Ссылка на компонент/устройство/слот, если извлекается |
+| `fingerprint` | string | нет | Внешний готовый dedup-key; если не передан, система вычисляет свой |
+| `is_active` | bool | нет | Признак, что событие всё ещё активно/не погашено, если источник умеет lifecycle |
+| `raw_payload` | object | нет | Сырой vendor-specific payload для диагностики |
+
+**Правила event_logs:**
+- Логи дедуплицируются в рамках asset + source + fingerprint.
+- Если `fingerprint` не передан, система строит его из нормализованных полей (`source`, `message_id`, `message`, `component_ref`, временная нормализация).
+- Интегратор/сборщик логов не должен синтезировать содержимое событий: не придумывайте `message`, `message_id`, `component_ref`, serial/device identifiers или иные поля, если они отсутствуют в исходном логе или не были надёжно извлечены.
+- Повторное получение того же события обновляет `last_seen_at`/счётчик повторов и не должно создавать новый timeline/history event.
+- `event_logs` используются для отдельного UI-представления логов и не изменяют canonical state компонентов/asset по умолчанию.
+
+```json
+"event_logs": [
+  {
+    "source": "bmc",
+    "event_time": "2026-03-15T14:03:11Z",
+    "severity": "Warning",
+    "message_id": "0x000F",
+    "message": "Correctable ECC error threshold exceeded",
+    "component_ref": "CPU0_C0D0",
+    "raw_payload": {
+      "sensor": "DIMM_A1",
+      "sel_record_id": "0042"
+    }
+  },
+  {
+    "source": "redfish",
+    "event_time": "2026-03-15T14:03:20Z",
+    "severity": "Info",
+    "message_id": "OpenBMC.0.1.SystemReboot",
+    "message": "System reboot requested by administrator",
+    "component_ref": "Mainboard"
+  }
+]
+```
+
 #### sensors.fans
 
 | Поле | Тип | Обязательно | Описание |
@@ -608,10 +669,12 @@ PSU без `serial_number` игнорируется.
 
 ## Обработка отсутствующих serial_number
 
+Общее правило для всех секций: если источник не вернул серийный номер и сборщик не смог его надёжно извлечь, интегратор не должен подставлять вымышленные значения, хеши, локальные placeholder-идентификаторы или серийные номера "по догадке". Разрешены только явно оговорённые ниже server-side fallback-правила ingest.
+
 | Тип | Поведение |
 |-----|-----------|
 | CPU | Генерируется: `{board_serial}-CPU-{socket}` |
-| PCIe | Генерируется: `{board_serial}-PCIE-{slot}` (если serial = `"N/A"` или пустой) |
+| PCIe | Генерируется: `{board_serial}-PCIE-{slot}` (если serial = `"N/A"` или пустой; `slot` для PCIe = BDF) |
 | Memory | Компонент игнорируется |
 | Storage | Компонент игнорируется |
 | PSU | Компонент игнорируется |
@@ -687,7 +750,7 @@ PSU без `serial_number` игнорируется.
     ],
     "pcie_devices": [
       {
-        "slot": "PCIeCard1",
+        "slot": "0000:18:00.0",
         "device_class": "EthernetController",
         "manufacturer": "Intel",
         "model": "X710 10GbE",

iso/builder/Dockerfile

@@ -1,7 +1,6 @@
 FROM debian:12
 
-ARG GO_VERSION=1.23.6
-ARG DEBIAN_KERNEL_ABI=6.1.0-43
+ARG GO_VERSION=1.24.0
 
 ENV DEBIAN_FRONTEND=noninteractive
 
@@ -24,7 +23,7 @@ RUN apt-get update -qq && apt-get install -y \
     gcc \
     make \
     perl \
-    "linux-headers-${DEBIAN_KERNEL_ABI}-amd64" \
+    linux-headers-amd64 \
     && rm -rf /var/lib/apt/lists/*
 
 RUN arch="$(dpkg --print-architecture)" \

iso/builder/VERSIONS

@@ -1,5 +1,8 @@
 DEBIAN_VERSION=12
-DEBIAN_KERNEL_ABI=6.1.0-43
+DEBIAN_KERNEL_ABI=auto
 NVIDIA_DRIVER_VERSION=590.48.01
-GO_VERSION=1.23.6
-AUDIT_VERSION=0.1.1
+NCCL_VERSION=2.28.9-1
+NCCL_CUDA_VERSION=13.0
+NCCL_SHA256=2e6faafd2c19cffc7738d9283976a3200ea9db9895907f337f0c7e5a25563186
+GO_VERSION=1.24.0
+AUDIT_VERSION=1.0.0

iso/builder/auto/config

@@ -7,6 +7,15 @@ set -e
 
 . "$(dirname "$0")/../VERSIONS"
 
+# Pin the exact kernel ABI detected by build.sh so the ISO kernel matches
+# the kernel headers used to compile NVIDIA modules. Falls back to meta-package
+# when lb config is run manually without the environment variable.
+if [ -n "${BEE_KERNEL_ABI:-}" ] && [ "${BEE_KERNEL_ABI}" != "auto" ]; then
+    LB_LINUX_PACKAGES="linux-image-${BEE_KERNEL_ABI}"
+else
+    LB_LINUX_PACKAGES="linux-image"
+fi
+
 lb config noauto \
     --distribution bookworm \
     --architectures amd64 \
@@ -19,10 +28,10 @@ lb config noauto \
     --mirror-binary "https://deb.debian.org/debian" \
     --security true \
     --linux-flavours "amd64" \
-    --linux-packages "linux-image-${DEBIAN_KERNEL_ABI}" \
+    --linux-packages "${LB_LINUX_PACKAGES}" \
     --memtest none \
-    --iso-volume "BEE" \
-    --iso-application "Bee Hardware Audit" \
-    --bootappend-live "boot=live components console=tty0 console=ttyS0,115200n8 username=bee user-fullname=Bee modprobe.blacklist=nouveau" \
+    --iso-volume "EASY-BEE" \
+    --iso-application "EASY-BEE" \
+    --bootappend-live "boot=live components console=ttyS0,115200n8 console=ttyS1,115200n8 loglevel=7 systemd.log_target=console systemd.journald.forward_to_console=1 systemd.journald.max_level_console=debug username=bee user-fullname=Bee modprobe.blacklist=nouveau" \
     --apt-recommends false \
     "${@}"

iso/builder/build-in-container.sh

@@ -1,5 +1,5 @@
 #!/bin/sh
-# build-in-container.sh — build the bee ISO inside a Debian container.
+# build-in-container.sh — build the bee ISO inside the Debian builder container.
 
 set -e
 
@@ -59,7 +59,6 @@ IMAGE_REF="${IMAGE_TAG}:debian${DEBIAN_VERSION}"
 if [ "$REBUILD_IMAGE" = "1" ] || ! "$CONTAINER_TOOL" image inspect "${IMAGE_REF}" >/dev/null 2>&1; then
     "$CONTAINER_TOOL" build \
         --build-arg GO_VERSION="${GO_VERSION}" \
-        --build-arg DEBIAN_KERNEL_ABI="${DEBIAN_KERNEL_ABI}" \
         -t "${IMAGE_REF}" \
         "${BUILDER_DIR}"
 else
@@ -70,6 +69,7 @@ set -- \
     run --rm --privileged \
     -v "${REPO_ROOT}:/work" \
     -v "${CACHE_DIR}:/cache" \
+    -e BEE_CONTAINER_BUILD=1 \
     -e GOCACHE=/cache/go-build \
     -e GOMODCACHE=/cache/go-mod \
     -e TMPDIR=/cache/tmp \
@@ -83,6 +83,7 @@ if [ -n "$AUTH_KEYS" ]; then
         -v "${REPO_ROOT}:/work" \
         -v "${CACHE_DIR}:/cache" \
         -v "${AUTH_KEYS_DIR}:/tmp/bee-authkeys:ro" \
+        -e BEE_CONTAINER_BUILD=1 \
         -e GOCACHE=/cache/go-build \
         -e GOMODCACHE=/cache/go-mod \
         -e TMPDIR=/cache/tmp \

iso/builder/build-nccl.sh

@@ -0,0 +1,94 @@
+#!/bin/sh
+# build-nccl.sh — download and extract NCCL shared library for the LiveCD.
+#
+# Downloads libnccl2 .deb from NVIDIA's CUDA apt repository (Debian 12, x86_64)
+# and extracts the shared library. Package integrity verified via sha256.
+#
+# Output is cached in DIST_DIR/nccl-<version>+cuda<cuda>/ so subsequent builds
+# are instant unless NCCL_VERSION or NCCL_CUDA_VERSION changes.
+#
+# Output layout:
+#   $CACHE_DIR/lib/   — libnccl.so.* files
+
+set -e
+
+NCCL_VERSION="$1"
+NCCL_CUDA_VERSION="$2"
+DIST_DIR="$3"
+EXPECTED_SHA256="$4"
+
+[ -n "$NCCL_VERSION" ]      || { echo "usage: $0 <nccl-version> <cuda-version> <dist-dir> [sha256]"; exit 1; }
+[ -n "$NCCL_CUDA_VERSION" ] || { echo "usage: $0 <nccl-version> <cuda-version> <dist-dir> [sha256]"; exit 1; }
+[ -n "$DIST_DIR" ]          || { echo "usage: $0 <nccl-version> <cuda-version> <dist-dir> [sha256]"; exit 1; }
+
+echo "=== NCCL ${NCCL_VERSION}+cuda${NCCL_CUDA_VERSION} ==="
+
+CACHE_DIR="${DIST_DIR}/nccl-${NCCL_VERSION}+cuda${NCCL_CUDA_VERSION}"
+CACHE_ROOT="${BEE_CACHE_DIR:-${DIST_DIR}/cache}"
+DOWNLOAD_CACHE_DIR="${CACHE_ROOT}/nccl-downloads"
+
+if [ -d "$CACHE_DIR/lib" ] && [ "$(ls "$CACHE_DIR/lib/"libnccl.so.* 2>/dev/null | wc -l)" -gt 0 ]; then
+    echo "=== NCCL cached, skipping download ==="
+    echo "cache: $CACHE_DIR"
+    echo "libs: $(ls "$CACHE_DIR/lib/" | wc -l) files"
+    exit 0
+fi
+
+REPO_BASE="https://developer.download.nvidia.com/compute/cuda/repos/debian12/x86_64"
+PKG_NAME="libnccl2_${NCCL_VERSION}+cuda${NCCL_CUDA_VERSION}_amd64.deb"
+PKG_URL="${REPO_BASE}/${PKG_NAME}"
+
+mkdir -p "$DOWNLOAD_CACHE_DIR"
+DEB_FILE="${DOWNLOAD_CACHE_DIR}/${PKG_NAME}"
+
+echo "=== downloading NCCL package ==="
+echo "URL: ${PKG_URL}"
+wget --show-progress -O "$DEB_FILE" "$PKG_URL"
+
+if [ -n "$EXPECTED_SHA256" ]; then
+    echo "=== verifying sha256 ==="
+    ACTUAL_SHA256=$(sha256sum "$DEB_FILE" | awk '{print $1}')
+    if [ "$ACTUAL_SHA256" != "$EXPECTED_SHA256" ]; then
+        echo "ERROR: sha256 mismatch"
+        echo "  expected: $EXPECTED_SHA256"
+        echo "  actual:   $ACTUAL_SHA256"
+        rm -f "$DEB_FILE"
+        exit 1
+    fi
+    echo "sha256 OK"
+fi
+
+echo "=== extracting NCCL libraries ==="
+EXTRACT_TMP=$(mktemp -d)
+trap 'rm -rf "$EXTRACT_TMP"' EXIT INT TERM
+
+# .deb is an ar archive; data.tar.* contains the actual files
+cd "$EXTRACT_TMP"
+ar x "$DEB_FILE"
+
+# Extract data tarball (xz, gz, or zst)
+DATA_TAR=$(ls data.tar.* 2>/dev/null | head -1)
+[ -n "$DATA_TAR" ] || { echo "ERROR: data.tar.* not found in .deb"; exit 1; }
+tar xf "$DATA_TAR"
+
+# Library lands in ./usr/lib/x86_64-linux-gnu/ or ./usr/lib/
+mkdir -p "$CACHE_DIR/lib"
+found=0
+for f in $(find . -name 'libnccl.so.*' -not -type d 2>/dev/null); do
+    cp "$f" "$CACHE_DIR/lib/"
+    found=$((found + 1))
+done
+
+[ "$found" -gt 0 ] || { echo "ERROR: libnccl.so.* not found in package"; exit 1; }
+
+# Create soname symlinks: libnccl.so.2 -> libnccl.so.<full>, libnccl.so -> libnccl.so.2
+versioned=$(ls "$CACHE_DIR/lib/libnccl.so."[0-9][0-9.]* 2>/dev/null | head -1)
+if [ -n "$versioned" ]; then
+    base=$(basename "$versioned")
+    ln -sf "$base" "$CACHE_DIR/lib/libnccl.so.2" 2>/dev/null || true
+    ln -sf "libnccl.so.2" "$CACHE_DIR/lib/libnccl.so" 2>/dev/null || true
+fi
+
+echo "=== NCCL extraction complete ==="
+echo "cache: $CACHE_DIR"
+ls -lh "$CACHE_DIR/lib/"

iso/builder/build.sh

@@ -1,14 +1,13 @@
 #!/bin/sh
-# build.sh — build bee ISO (Debian 12 / live-build)
-#
-# Single build script. Produces a bootable live ISO with SSH access, TUI, NVIDIA drivers.
-#
-# Run on Debian 12 builder VM as root after setup-builder.sh.
-# Usage:
-#   sh iso/builder/build.sh [--authorized-keys /path/to/authorized_keys]
+# build.sh — internal ISO build entrypoint executed inside the builder container.
 
 set -e
 
+if [ "${BEE_CONTAINER_BUILD:-0}" != "1" ]; then
+    echo "build.sh must run inside iso/builder/build-in-container.sh" >&2
+    exit 1
+fi
+
 REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
 BUILDER_DIR="${REPO_ROOT}/iso/builder"
 OVERLAY_DIR="${REPO_ROOT}/iso/overlay"
@@ -35,10 +34,79 @@ mkdir -p "${CACHE_ROOT}"
 : "${GOMODCACHE:=${CACHE_ROOT}/go-mod}"
 export GOCACHE GOMODCACHE
 
+resolve_audit_version() {
+    if [ -n "${BEE_AUDIT_VERSION:-}" ]; then
+        echo "${BEE_AUDIT_VERSION}"
+        return 0
+    fi
+
+    tag="$(git -C "${REPO_ROOT}" describe --tags --match 'audit/v*' --abbrev=7 --dirty 2>/dev/null || true)"
+    if [ -z "${tag}" ]; then
+        tag="$(git -C "${REPO_ROOT}" describe --tags --match 'v*' --abbrev=7 --dirty 2>/dev/null || true)"
+    fi
+    case "${tag}" in
+        audit/v*)
+            echo "${tag#audit/v}"
+            return 0
+            ;;
+        v*)
+            echo "${tag#v}"
+            return 0
+            ;;
+        "")
+            ;;
+        *)
+            echo "${tag}"
+            return 0
+            ;;
+    esac
+
+    if [ -n "${AUDIT_VERSION:-}" ]; then
+        echo "${AUDIT_VERSION}"
+        return 0
+    fi
+
+    date +%Y%m%d
+}
+
+AUDIT_VERSION_EFFECTIVE="$(resolve_audit_version)"
+
+# Auto-detect kernel ABI: refresh apt index, then query current linux-image-amd64 dependency.
+# If headers for the detected ABI are not yet installed (kernel updated since image build),
+# install them on the fly so NVIDIA modules and ISO kernel always match.
+if [ -z "${DEBIAN_KERNEL_ABI}" ] || [ "${DEBIAN_KERNEL_ABI}" = "auto" ]; then
+    echo "=== refreshing apt index to detect current kernel ABI ==="
+    apt-get update -qq
+    DEBIAN_KERNEL_ABI=$(apt-cache depends linux-image-amd64 2>/dev/null \
+        | awk '/Depends:.*linux-image-[0-9]/{print $2}' \
+        | grep -oE '[0-9]+\.[0-9]+\.[0-9]+-[0-9]+' \
+        | head -1)
+    if [ -z "${DEBIAN_KERNEL_ABI}" ]; then
+        echo "ERROR: could not auto-detect kernel ABI from apt-cache" >&2
+        exit 1
+    fi
+    echo "=== kernel ABI: ${DEBIAN_KERNEL_ABI} ==="
+fi
+
+# Export detected ABI so that auto/config can pin the exact kernel package
+# (prevents NVIDIA module/kernel mismatch if linux-image-amd64 meta-package
+# gets updated between build.sh start and lb build chroot step)
+export BEE_KERNEL_ABI="${DEBIAN_KERNEL_ABI}"
+
+KVER="${DEBIAN_KERNEL_ABI}-amd64"
+if [ ! -d "/usr/src/linux-headers-${KVER}" ]; then
+    echo "=== installing linux-headers-${KVER} (kernel updated since image build) ==="
+    apt-get install -y "linux-headers-${KVER}"
+fi
+
 echo "=== bee ISO build ==="
 echo "Debian: ${DEBIAN_VERSION}, Kernel ABI: ${DEBIAN_KERNEL_ABI}, Go: ${GO_VERSION}"
+echo "Audit version: ${AUDIT_VERSION_EFFECTIVE}"
 echo ""
 
+echo "=== syncing git submodules ==="
+git -C "${REPO_ROOT}" submodule update --init --recursive
+
 # --- compile bee binary (static, Linux amd64) ---
 BEE_BIN="${DIST_DIR}/bee-linux-amd64"
 GPU_STRESS_BIN="${DIST_DIR}/bee-gpu-stress-linux-amd64"
@@ -53,7 +121,7 @@ if [ "$NEED_BUILD" = "1" ]; then
     cd "${REPO_ROOT}/audit"
     GOOS=linux GOARCH=amd64 CGO_ENABLED=0 \
         go build \
-        -ldflags "-s -w -X main.Version=${AUDIT_VERSION:-$(date +%Y%m%d)}" \
+        -ldflags "-s -w -X main.Version=${AUDIT_VERSION_EFFECTIVE}" \
         -o "$BEE_BIN" \
         ./cmd/bee
     echo "binary: $BEE_BIN"
@@ -184,18 +252,31 @@ if [ -d "${NVIDIA_CACHE}/firmware" ] && [ "$(ls -A "${NVIDIA_CACHE}/firmware" 2>
     echo "=== firmware: $(ls "${OVERLAY_STAGE_DIR}/lib/firmware/nvidia/${NVIDIA_DRIVER_VERSION}/" | wc -l) files injected ==="
 fi
 
+# --- build / download NCCL ---
+echo ""
+echo "=== downloading NCCL ${NCCL_VERSION}+cuda${NCCL_CUDA_VERSION} ==="
+sh "${BUILDER_DIR}/build-nccl.sh" "${NCCL_VERSION}" "${NCCL_CUDA_VERSION}" "${DIST_DIR}" "${NCCL_SHA256:-}"
+
+NCCL_CACHE="${DIST_DIR}/nccl-${NCCL_VERSION}+cuda${NCCL_CUDA_VERSION}"
+
+# Inject libnccl.so.* into overlay alongside other NVIDIA userspace libs
+cp "${NCCL_CACHE}/lib/"* "${OVERLAY_STAGE_DIR}/usr/lib/"
+echo "=== NCCL: $(ls "${NCCL_CACHE}/lib/" | wc -l) files injected into /usr/lib/ ==="
+
 # --- embed build metadata ---
 mkdir -p "${OVERLAY_STAGE_DIR}/etc"
 BUILD_DATE="$(date +%Y-%m-%d)"
 GIT_COMMIT="$(git -C "${REPO_ROOT}" rev-parse --short HEAD 2>/dev/null || echo unknown)"
 cat > "${OVERLAY_STAGE_DIR}/etc/bee-release" <<EOF
-BEE_ISO_VERSION=${AUDIT_VERSION}
-BEE_AUDIT_VERSION=${AUDIT_VERSION}
+BEE_ISO_VERSION=${AUDIT_VERSION_EFFECTIVE}
+BEE_AUDIT_VERSION=${AUDIT_VERSION_EFFECTIVE}
 BUILD_DATE=${BUILD_DATE}
 GIT_COMMIT=${GIT_COMMIT}
 DEBIAN_VERSION=${DEBIAN_VERSION}
 DEBIAN_KERNEL_ABI=${DEBIAN_KERNEL_ABI}
 NVIDIA_DRIVER_VERSION=${NVIDIA_DRIVER_VERSION}
+NCCL_VERSION=${NCCL_VERSION}
+NCCL_CUDA_VERSION=${NCCL_CUDA_VERSION}
 EOF
 
 # Patch motd with build info
@@ -229,7 +310,7 @@ lb build 2>&1
 
 # live-build outputs live-image-amd64.hybrid.iso in LB_DIR
 ISO_RAW="${LB_DIR}/live-image-amd64.hybrid.iso"
-ISO_OUT="${DIST_DIR}/bee-debian${DEBIAN_VERSION}-v${AUDIT_VERSION}-amd64.iso"
+ISO_OUT="${DIST_DIR}/bee-debian${DEBIAN_VERSION}-v${AUDIT_VERSION_EFFECTIVE}-amd64.iso"
 if [ -f "$ISO_RAW" ]; then
     cp "$ISO_RAW" "$ISO_OUT"
     echo ""

iso/builder/config/bootloaders/grub-pc/grub.cfg

@@ -1,12 +1,26 @@
 source /boot/grub/config.cfg
 
-menuentry "Bee Hardware Audit" {
-    linux   @KERNEL_LIVE@ @APPEND_LIVE@
+echo ""
+echo "  ███████╗ █████╗ ███████╗██╗   ██╗      ██████╗ ███████╗███████╗"
+echo "  ██╔════╝██╔══██╗██╔════╝╚██╗ ██╔╝      ██╔══██╗██╔════╝██╔════╝"
+echo "  █████╗  ███████║███████╗ ╚████╔╝ █████╗██████╔╝█████╗  █████╗"
+echo "  ██╔══╝  ██╔══██║╚════██║  ╚██╔╝  ╚════╝██╔══██╗██╔══╝  ██╔══╝"
+echo "  ███████╗██║  ██║███████║   ██║         ██████╔╝███████╗███████╗"
+echo "  ╚══════╝╚═╝  ╚═╝╚══════╝   ╚═╝         ╚═════╝ ╚══════╝╚══════╝"
+echo ""
+
+menuentry "EASY-BEE" {
+    linux   @KERNEL_LIVE@ @APPEND_LIVE@ bee.nvidia.mode=normal
     initrd  @INITRD_LIVE@
 }
 
-menuentry "Bee Hardware Audit (fail-safe)" {
-    linux   @KERNEL_LIVE@ @APPEND_LIVE@ memtest noapic noapm nodma nomce nolapic nosmp vga=normal
+menuentry "EASY-BEE (NVIDIA GSP=off)" {
+    linux   @KERNEL_LIVE@ @APPEND_LIVE@ bee.nvidia.mode=gsp-off
+    initrd  @INITRD_LIVE@
+}
+
+menuentry "EASY-BEE (fail-safe)" {
+    linux   @KERNEL_LIVE@ @APPEND_LIVE@ bee.nvidia.mode=gsp-off memtest noapic noapm nodma nomce nolapic nosmp vga=normal
     initrd  @INITRD_LIVE@
 }
 

iso/builder/config/bootloaders/grub-pc/live-theme/theme.txt

@@ -1,4 +1,4 @@
-desktop-image: "../splash.png"
+desktop-color: "#000000"
 title-color: "#f5a800"
 title-font: "Unifont Regular 16"
 title-text: ""

iso/builder/config/bootloaders/isolinux/live.cfg.in

@@ -0,0 +1,18 @@
+label live-@FLAVOUR@-normal
+    menu label ^EASY-BEE
+    menu default
+    linux @LINUX@
+    initrd @INITRD@
+    append @APPEND_LIVE@ bee.nvidia.mode=normal
+
+label live-@FLAVOUR@-gsp-off
+    menu label EASY-BEE (^NVIDIA GSP=off)
+    linux @LINUX@
+    initrd @INITRD@
+    append @APPEND_LIVE@ bee.nvidia.mode=gsp-off
+
+label live-@FLAVOUR@-failsafe
+    menu label EASY-BEE (^fail-safe)
+    linux @LINUX@
+    initrd @INITRD@
+    append @APPEND_LIVE@ bee.nvidia.mode=gsp-off memtest noapic noapm nodma nomce nolapic nosmp vga=normal

iso/builder/config/hooks/normal/9000-bee-setup.hook.chroot

@@ -5,14 +5,33 @@ set -e
 
 echo "=== bee chroot setup ==="
 
+ensure_bee_console_user() {
+    if id bee >/dev/null 2>&1; then
+        usermod -d /home/bee -s /bin/sh bee 2>/dev/null || true
+    else
+        useradd -d /home/bee -m -s /bin/sh -U bee
+    fi
+
+    mkdir -p /home/bee
+    chown -R bee:bee /home/bee
+    echo "bee:eeb" | chpasswd
+    usermod -aG sudo bee 2>/dev/null || true
+}
+
+ensure_bee_console_user
+
 # Enable bee services
 systemctl enable bee-network.service
 systemctl enable bee-nvidia.service
+systemctl enable bee-preflight.service
 systemctl enable bee-audit.service
+systemctl enable bee-web.service
 systemctl enable bee-sshsetup.service
 systemctl enable ssh.service
 systemctl enable qemu-guest-agent.service 2>/dev/null || true
 systemctl enable serial-getty@ttyS0.service 2>/dev/null || true
+systemctl enable serial-getty@ttyS1.service 2>/dev/null || true
+systemctl enable bee-journal-mirror@ttyS1.service 2>/dev/null || true
 
 # Ensure scripts are executable
 chmod +x /usr/local/bin/bee-network.sh  2>/dev/null || true
@@ -21,12 +40,13 @@ chmod +x /usr/local/bin/bee-sshsetup   2>/dev/null || true
 chmod +x /usr/local/bin/bee-smoketest  2>/dev/null || true
 chmod +x /usr/local/bin/bee-tui        2>/dev/null || true
 chmod +x /usr/local/bin/bee            2>/dev/null || true
+chmod +x /usr/local/bin/bee-log-run    2>/dev/null || true
 
 # Reload udev rules
 udevadm control --reload-rules 2>/dev/null || true
 
-# Create log directory
-mkdir -p /var/log
+# Create export directory
+mkdir -p /appdata/bee/export
 
 if [ -f /etc/sudoers.d/bee ]; then
     chmod 0440 /etc/sudoers.d/bee

iso/builder/config/hooks/normal/9001-amd-rocm.hook.chroot

@@ -0,0 +1,78 @@
+#!/bin/sh
+# 9001-amd-rocm.hook.chroot — install AMD ROCm SMI tool for Instinct GPU monitoring.
+# Runs inside the live-build chroot. Adds AMD's apt repository and installs
+# rocm-smi-lib which provides the `rocm-smi` CLI (analogous to nvidia-smi).
+
+set -e
+
+ROCM_VERSION="6.4"
+ROCM_KEYRING="/etc/apt/keyrings/rocm.gpg"
+ROCM_LIST="/etc/apt/sources.list.d/rocm.list"
+APT_UPDATED=0
+
+echo "=== AMD ROCm ${ROCM_VERSION}: adding repository ==="
+
+mkdir -p /etc/apt/keyrings
+
+ensure_tool() {
+    tool="$1"
+    pkg="$2"
+    if command -v "${tool}" >/dev/null 2>&1; then
+        return 0
+    fi
+    if [ "${APT_UPDATED}" -eq 0 ]; then
+        apt-get update -qq
+        APT_UPDATED=1
+    fi
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends "${pkg}"
+}
+
+ensure_cert_bundle() {
+    if [ -s /etc/ssl/certs/ca-certificates.crt ]; then
+        return 0
+    fi
+    if [ "${APT_UPDATED}" -eq 0 ]; then
+        apt-get update -qq
+        APT_UPDATED=1
+    fi
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends ca-certificates
+}
+
+# live-build chroot may not include fetch/signing tools yet
+if ! ensure_cert_bundle || ! ensure_tool wget wget || ! ensure_tool gpg gpg; then
+    echo "WARN: failed to install wget/gpg/ca-certificates prerequisites — skipping ROCm install"
+    exit 0
+fi
+
+# Download and import AMD GPG key
+if ! wget -qO- "https://repo.radeon.com/rocm/rocm.gpg.key" \
+        | gpg --dearmor --yes --output "${ROCM_KEYRING}"; then
+    echo "WARN: failed to fetch AMD ROCm GPG key — skipping ROCm install"
+    exit 0
+fi
+
+cat > "${ROCM_LIST}" <<EOF
+deb [arch=amd64 signed-by=${ROCM_KEYRING}] https://repo.radeon.com/rocm/apt/${ROCM_VERSION} bookworm main
+EOF
+
+apt-get update -qq
+
+# rocm-smi-lib provides the rocm-smi CLI tool for GPU monitoring
+if apt-get install -y --no-install-recommends rocm-smi-lib 2>/dev/null; then
+    echo "=== AMD ROCm: rocm-smi installed ==="
+    if [ -x /opt/rocm/bin/rocm-smi ]; then
+        ln -sf /opt/rocm/bin/rocm-smi /usr/local/bin/rocm-smi
+    else
+        candidate="$(find /opt -path '*/bin/rocm-smi' -type f 2>/dev/null | sort | tail -1)"
+        if [ -n "${candidate}" ]; then
+            ln -sf "${candidate}" /usr/local/bin/rocm-smi
+        fi
+    fi
+    rocm-smi --version 2>/dev/null || true
+else
+    echo "WARN: rocm-smi-lib install failed — GPU monitoring unavailable"
+fi
+
+# Clean up apt lists to keep ISO size down
+rm -f "${ROCM_LIST}"
+apt-get clean

iso/builder/config/package-lists/bee.list.chroot

@@ -18,6 +18,10 @@ qemu-guest-agent
 # SSH
 openssh-server
 
+# Filesystem support for USB export targets
+exfatprogs
+ntfs-3g
+
 # Utilities
 bash
 procps
@@ -27,16 +31,19 @@ less
 vim-tiny
 mc
 htop
+nvtop
 sudo
 zstd
 mstflint
 memtester
+stress-ng
 
 # QR codes (for displaying audit results)
 qrencode
 
 # Firmware
 firmware-linux-free
+firmware-amd-graphics
 
 # glibc compat helpers (for any external binaries that need it)
 libc6

iso/builder/setup-builder.sh

@@ -1,75 +0,0 @@
-#!/bin/sh
-# setup-builder.sh — prepare Debian 12 host/VM as bee ISO builder
-#
-# Run once on a fresh Debian 12 (Bookworm) host/VM as root.
-# After this script completes, the machine can build bee ISO images directly.
-# Container alternative: use `iso/builder/build-in-container.sh`.
-#
-# Usage (on Debian VM):
-#   wget -O- https://git.mchus.pro/mchus/bee/raw/branch/main/iso/builder/setup-builder.sh | sh
-#   or: sh setup-builder.sh
-
-set -e
-
-. "$(dirname "$0")/VERSIONS" 2>/dev/null || true
-GO_VERSION="${GO_VERSION:-1.23.6}"
-DEBIAN_VERSION="${DEBIAN_VERSION:-12}"
-DEBIAN_KERNEL_ABI="${DEBIAN_KERNEL_ABI:-6.1.0-28}"
-
-echo "=== bee builder setup ==="
-echo "Debian: $(cat /etc/debian_version)"
-echo "Go target: ${GO_VERSION}"
-echo "Kernel ABI: ${DEBIAN_KERNEL_ABI}"
-echo ""
-
-# --- system packages ---
-export DEBIAN_FRONTEND=noninteractive
-apt-get update -qq
-
-apt-get install -y \
-    live-build \
-    debootstrap \
-    squashfs-tools \
-    xorriso \
-    grub-pc-bin \
-    grub-efi-amd64-bin \
-    mtools \
-    git \
-    wget \
-    curl \
-    tar \
-    xz-utils \
-    screen \
-    rsync \
-    build-essential \
-    gcc \
-    make \
-    perl \
-    "linux-headers-${DEBIAN_KERNEL_ABI}-amd64"
-
-echo "linux-headers installed: $(dpkg -l "linux-headers-${DEBIAN_KERNEL_ABI}-amd64" | awk '/^ii/{print $3}')"
-
-# --- Go toolchain ---
-echo ""
-echo "=== installing Go ${GO_VERSION} ==="
-if [ -d /usr/local/go ] && /usr/local/go/bin/go version 2>/dev/null | grep -q "${GO_VERSION}"; then
-    echo "Go ${GO_VERSION} already installed"
-else
-    ARCH=$(uname -m)
-    case "$ARCH" in
-        x86_64) GOARCH=amd64 ;;
-        aarch64) GOARCH=arm64 ;;
-        *) echo "unsupported arch: $ARCH"; exit 1 ;;
-    esac
-    wget -O /tmp/go.tar.gz \
-        "https://go.dev/dl/go${GO_VERSION}.linux-${GOARCH}.tar.gz"
-    rm -rf /usr/local/go
-    tar -C /usr/local -xzf /tmp/go.tar.gz
-    rm /tmp/go.tar.gz
-fi
-export PATH="$PATH:/usr/local/go/bin"
-echo "Go: $(go version)"
-
-echo ""
-echo "=== builder setup complete ==="
-echo "Next: sh iso/builder/build.sh"

iso/builder/smoketest.sh

@@ -26,6 +26,15 @@ echo ""
 
 KVER=$(uname -r)
 info "kernel: $KVER"
+NVIDIA_BOOT_MODE="normal"
+for arg in $(cat /proc/cmdline 2>/dev/null); do
+    case "$arg" in
+        bee.nvidia.mode=*)
+            NVIDIA_BOOT_MODE="${arg#*=}"
+            ;;
+    esac
+done
+info "nvidia boot mode: ${NVIDIA_BOOT_MODE}"
 
 # --- PATH & binaries ---
 echo "-- PATH & binaries --"
@@ -53,17 +62,25 @@ else
     fail "NVIDIA ko dir missing: $KO_DIR"
 fi
 
-for mod in nvidia nvidia_modeset nvidia_uvm; do
+if /sbin/lsmod 2>/dev/null | grep -q "^nvidia "; then
+    ok "module loaded: nvidia"
+else
+    fail "module NOT loaded: nvidia"
+fi
+
+for mod in nvidia_modeset nvidia_uvm; do
     if /sbin/lsmod 2>/dev/null | grep -q "^$mod "; then
         ok "module loaded: $mod"
+    elif [ "${NVIDIA_BOOT_MODE}" = "normal" ] || [ "${NVIDIA_BOOT_MODE}" = "full" ]; then
+        fail "module NOT loaded in normal mode: $mod"
     else
-        fail "module NOT loaded: $mod"
+        warn "module not loaded in GSP-off mode: $mod"
     fi
 done
 
 echo ""
 echo "-- NVIDIA device nodes --"
-for dev in nvidiactl nvidia0 nvidia-uvm; do
+for dev in nvidiactl nvidia0; do
     if [ -e "/dev/$dev" ]; then
         ok "/dev/$dev exists"
     else
@@ -71,6 +88,14 @@ for dev in nvidiactl nvidia0 nvidia-uvm; do
     fi
 done
 
+if [ -e /dev/nvidia-uvm ]; then
+    ok "/dev/nvidia-uvm exists"
+elif [ "${NVIDIA_BOOT_MODE}" = "normal" ] || [ "${NVIDIA_BOOT_MODE}" = "full" ]; then
+    fail "/dev/nvidia-uvm missing in normal mode"
+else
+    warn "/dev/nvidia-uvm missing — CUDA stress path may be unavailable until loaded on demand"
+fi
+
 echo ""
 echo "-- nvidia-smi --"
 if PATH="/usr/local/bin:$PATH" command -v nvidia-smi >/dev/null 2>&1; then
@@ -96,7 +121,7 @@ done
 
 echo ""
 echo "-- systemd services --"
-for svc in bee-nvidia bee-network bee-audit; do
+for svc in bee-nvidia bee-network bee-preflight bee-audit bee-web; do
     if systemctl is-active --quiet "$svc" 2>/dev/null; then
         ok "service active: $svc"
     else
@@ -104,6 +129,20 @@ for svc in bee-nvidia bee-network bee-audit; do
     fi
 done
 
+echo ""
+echo "-- runtime health --"
+if [ -f /appdata/bee/export/runtime-health.json ] && [ -s /appdata/bee/export/runtime-health.json ]; then
+    ok "runtime: runtime-health.json present and non-empty"
+else
+    fail "runtime: runtime-health.json missing or empty"
+fi
+
+if [ -f /appdata/bee/export/runtime-health.log ]; then
+    info "last runtime log line: $(tail -1 /appdata/bee/export/runtime-health.log)"
+else
+    warn "runtime: no log found at /appdata/bee/export/runtime-health.log"
+fi
+
 for svc in ssh bee-sshsetup; do
     if systemctl is-active --quiet "$svc" 2>/dev/null \
         || systemctl show "$svc" --property=ActiveState 2>/dev/null | grep -q "inactive\|exited"; then
@@ -126,29 +165,43 @@ fi
 
 echo ""
 echo "-- audit last run --"
-if [ -f /var/log/bee-audit.json ] && [ -s /var/log/bee-audit.json ]; then
+if [ -f /appdata/bee/export/bee-audit.json ] && [ -s /appdata/bee/export/bee-audit.json ]; then
     ok "audit: bee-audit.json present and non-empty"
-    info "size: $(du -sh /var/log/bee-audit.json | cut -f1)"
+    info "size: $(du -sh /appdata/bee/export/bee-audit.json | cut -f1)"
 else
     fail "audit: bee-audit.json missing or empty"
 fi
 
-if [ -f /var/log/bee-audit.log ]; then
-    last_line=$(tail -1 /var/log/bee-audit.log)
+if [ -f /appdata/bee/export/bee-audit.log ]; then
+    last_line=$(tail -1 /appdata/bee/export/bee-audit.log)
     info "last log line: $last_line"
-    if grep -q "audit output written" /var/log/bee-audit.log 2>/dev/null; then
+    if grep -q "audit output written" /appdata/bee/export/bee-audit.log 2>/dev/null; then
         ok "audit: completed successfully"
     else
         warn "audit: 'audit output written' not found in log — may have failed"
     fi
-    if grep -q "nvidia: enrichment skipped\|nvidia.*skipped\|enrichment skipped" /var/log/bee-audit.log 2>/dev/null; then
-        reason=$(grep -E "nvidia.*skipped|enrichment skipped" /var/log/bee-audit.log | tail -1)
+    if grep -q "nvidia: enrichment skipped\|nvidia.*skipped\|enrichment skipped" /appdata/bee/export/bee-audit.log 2>/dev/null; then
+        reason=$(grep -E "nvidia.*skipped|enrichment skipped" /appdata/bee/export/bee-audit.log | tail -1)
         fail "audit: nvidia enrichment skipped — $reason"
     else
         ok "audit: nvidia enrichment OK (no skip message)"
     fi
 else
-    warn "audit: no log found at /var/log/bee-audit.log"
+    warn "audit: no log found at /appdata/bee/export/bee-audit.log"
+fi
+
+echo ""
+echo "-- bee web --"
+if [ -f /appdata/bee/export/bee-web.log ]; then
+    info "last web log line: $(tail -1 /appdata/bee/export/bee-web.log)"
+else
+    warn "web: no log found at /appdata/bee/export/bee-web.log"
+fi
+
+if bash -c 'exec 3<>/dev/tcp/127.0.0.1/80 && printf "GET /healthz HTTP/1.0\r\nHost: localhost\r\n\r\n" >&3 && grep -q "^ok$" <&3'; then
+    ok "web: health endpoint reachable on 127.0.0.1:80"
+else
+    fail "web: health endpoint not reachable on 127.0.0.1:80"
 fi
 
 echo ""

iso/overlay/etc/motd

@@ -1,15 +1,16 @@
 
-  ██████╗ ███████╗███████╗    ██████╗ ███████╗██████╗ ██╗   ██╗ ██████╗
-  ██╔══██╗██╔════╝██╔════╝    ██╔══██╗██╔════╝██╔══██╗██║   ██║██╔════╝
-  ██████╔╝█████╗  █████╗      ██║  ██║█████╗  ██████╔╝██║   ██║██║  ███╗
-  ██╔══██╗██╔══╝  ██╔══╝      ██║  ██║██╔══╝  ██╔══██╗██║   ██║██║   ██║
-  ██████╔╝███████╗███████╗    ██████╔╝███████╗██████╔╝╚██████╔╝╚██████╔╝
-  ╚═════╝ ╚══════╝╚══════╝    ╚═════╝ ╚══════╝╚═════╝  ╚═════╝  ╚═════╝
+  ███████╗ █████╗ ███████╗██╗   ██╗      ██████╗ ███████╗███████╗
+  ██╔════╝██╔══██╗██╔════╝╚██╗ ██╔╝      ██╔══██╗██╔════╝██╔════╝
+  █████╗  ███████║███████╗ ╚████╔╝ █████╗██████╔╝█████╗  █████╗
+  ██╔══╝  ██╔══██║╚════██║  ╚██╔╝  ╚════╝██╔══██╗██╔══╝  ██╔══╝
+  ███████╗██║  ██║███████║   ██║         ██████╔╝███████╗███████╗
+  ╚══════╝╚═╝  ╚═╝╚══════╝   ╚═╝         ╚═════╝ ╚══════╝╚══════╝
 
   Hardware Audit LiveCD
   Build: %%BUILD_INFO%%
 
-  Logs:          /var/log/bee-audit.json  /var/log/bee-network.log
+  Export dir:    /appdata/bee/export
+  Self-check:    /appdata/bee/export/runtime-health.json
 
   Open TUI:      bee-tui
 

iso/overlay/etc/profile.d/bee.sh

@@ -1,4 +1,4 @@
-export PATH="$PATH:/usr/local/bin"
+export PATH="$PATH:/usr/local/bin:/opt/rocm/bin:/opt/rocm/sbin"
 
 menu() {
     if [ -x /usr/local/bin/bee-tui ]; then

iso/overlay/etc/systemd/journald.conf.d/console-to-sol.conf

@@ -0,0 +1,4 @@
+[Journal]
+ForwardToConsole=yes
+TTYPath=/dev/ttyS0
+MaxLevelConsole=debug

iso/overlay/etc/systemd/system.conf.d/watchdog.conf

@@ -0,0 +1,4 @@
+[Manager]
+# Pet the hardware watchdog every 30s so the host doesn't reboot mid-audit.
+# Kernel watchdog timeout is typically 60s; 30s gives a safe 2× margin.
+RuntimeWatchdogSec=30s

iso/overlay/etc/systemd/system/bee-audit.service

@@ -1,12 +1,13 @@
 [Unit]
 Description=Bee: run hardware audit
-After=bee-network.service bee-nvidia.service
+After=bee-network.service bee-nvidia.service bee-preflight.service
+Before=bee-web.service
 
 [Service]
 Type=oneshot
-ExecStart=/bin/sh -c '/usr/local/bin/bee audit --runtime livecd --output file:/var/log/bee-audit.json; rc=$?; if [ "$rc" -ne 0 ]; then echo "[bee-audit] WARN: audit exited with rc=$rc"; fi; exit 0'
-StandardOutput=append:/var/log/bee-audit.log
-StandardError=append:/var/log/bee-audit.log
+ExecStart=/usr/local/bin/bee-log-run /appdata/bee/export/bee-audit.log /bin/sh -c '/usr/local/bin/bee audit --runtime livecd --output file:/appdata/bee/export/bee-audit.json; rc=$?; if [ "$rc" -ne 0 ]; then echo "[bee-audit] WARN: audit exited with rc=$rc"; fi; exit 0'
+StandardOutput=journal
+StandardError=journal
 RemainAfterExit=yes
 
 [Install]

iso/overlay/etc/systemd/system/bee-journal-mirror@.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=Bee: mirror system journal to %I
+After=systemd-journald.service
+Requires=systemd-journald.service
+ConditionPathExists=/dev/%I
+
+[Service]
+Type=simple
+ExecStart=/bin/sh -c 'exec journalctl -f -n 200 -o short-monotonic > /dev/%I'
+Restart=always
+RestartSec=1
+StandardOutput=null
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target

iso/overlay/etc/systemd/system/bee-network.service

@@ -5,9 +5,9 @@ Before=network-online.target bee-audit.service
 
 [Service]
 Type=oneshot
-ExecStart=/usr/local/bin/bee-network.sh
-StandardOutput=append:/var/log/bee-network.log
-StandardError=append:/var/log/bee-network.log
+ExecStart=/usr/local/bin/bee-log-run /appdata/bee/export/bee-network.log /usr/local/bin/bee-network.sh
+StandardOutput=journal
+StandardError=journal
 RemainAfterExit=yes
 
 [Install]

iso/overlay/etc/systemd/system/bee-nvidia.service

@@ -5,7 +5,7 @@ Before=bee-audit.service
 
 [Service]
 Type=oneshot
-ExecStart=/usr/local/bin/bee-nvidia-load
+ExecStart=/usr/local/bin/bee-log-run /appdata/bee/export/bee-nvidia.log /usr/local/bin/bee-nvidia-load
 StandardOutput=journal
 StandardError=journal
 RemainAfterExit=yes

iso/overlay/etc/systemd/system/bee-preflight.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=Bee: runtime preflight self-check
+After=bee-network.service bee-nvidia.service
+Before=bee-audit.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/bee-log-run /appdata/bee/export/runtime-health.log /bin/sh -c '/usr/local/bin/bee preflight --output file:/appdata/bee/export/runtime-health.json; rc=$?; if [ "$rc" -ne 0 ]; then echo "[bee-preflight] WARN: preflight exited with rc=$rc"; fi; exit 0'
+StandardOutput=journal
+StandardError=journal
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target

iso/overlay/etc/systemd/system/bee-sshsetup.service

@@ -5,7 +5,9 @@ Before=ssh.service
 
 [Service]
 Type=oneshot
-ExecStart=/usr/local/bin/bee-sshsetup
+ExecStart=/usr/local/bin/bee-log-run /appdata/bee/export/bee-sshsetup.log /usr/local/bin/bee-sshsetup
+StandardOutput=journal
+StandardError=journal
 RemainAfterExit=yes
 
 [Install]

iso/overlay/etc/systemd/system/bee-web.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=Bee: hardware audit web viewer
+After=bee-network.service bee-audit.service
+Wants=bee-audit.service
+
+[Service]
+Type=simple
+ExecStart=/usr/local/bin/bee-log-run /appdata/bee/export/bee-web.log /usr/local/bin/bee web --listen :80 --audit-path /appdata/bee/export/bee-audit.json --export-dir /appdata/bee/export --title "Bee Hardware Audit"
+Restart=always
+RestartSec=2
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target

iso/overlay/usr/local/bin/bee-log-run

@@ -0,0 +1,29 @@
+#!/bin/bash
+# bee-log-run — run a command, append its output to a file, and keep stdout/stderr
+# connected to systemd so journald and the serial console also receive the logs.
+
+set -o pipefail
+
+log_file="$1"
+shift
+
+if [ -z "$log_file" ] || [ "$#" -eq 0 ]; then
+    echo "usage: $0 <log-file> <command> [args...]" >&2
+    exit 2
+fi
+
+mkdir -p "$(dirname "$log_file")"
+
+serial_sink() {
+    local tty="$1"
+    if [ -w "$tty" ]; then
+        cat > "$tty"
+    else
+        cat > /dev/null
+    fi
+}
+
+"$@" 2>&1 | tee -a "$log_file" \
+    >(serial_sink /dev/ttyS0) \
+    >(serial_sink /dev/ttyS1)
+exit "${PIPESTATUS[0]}"

iso/overlay/usr/local/bin/bee-network.sh

@@ -20,10 +20,10 @@ fi
 
 for iface in $interfaces; do
     log "bringing up $iface"
-    ip link set "$iface" up 2>/dev/null || { log "WARN: could not bring up $iface"; continue; }
+    ip link set "$iface" up || { log "WARN: could not bring up $iface"; continue; }
 
-    # DHCP in background — non-blocking, retries indefinitely
-    dhclient -nw "$iface" 2>/dev/null &
+    # DHCP in background — non-blocking, keep dhclient verbose output in the service log.
+    dhclient -4 -v -nw "$iface" &
     log "DHCP started for $iface (pid $!)"
 done
 

iso/overlay/usr/local/bin/bee-nvidia-load

@@ -8,6 +8,12 @@ log() { echo "[bee-nvidia] $*"; }
 
 log "kernel: $(uname -r)"
 
+# Skip if no NVIDIA GPU present (PCI vendor 10de)
+if ! lspci -nn 2>/dev/null | grep -qi '10de:'; then
+    log "no NVIDIA GPU detected — skipping module load"
+    exit 0
+fi
+
 if [ ! -d "$NVIDIA_KO_DIR" ]; then
     log "ERROR: NVIDIA module dir missing: $NVIDIA_KO_DIR"
     exit 1
@@ -16,44 +22,82 @@ fi
 log "module dir: $NVIDIA_KO_DIR"
 ls "$NVIDIA_KO_DIR"/*.ko 2>/dev/null | sed 's/^/  /' || true
 
-# Load modules via insmod (direct load — no depmod needed)
-for mod in nvidia nvidia-modeset nvidia-uvm; do
+cmdline_param() {
+    key="$1"
+    for token in $(cat /proc/cmdline 2>/dev/null); do
+        case "$token" in
+            "$key"=*)
+                echo "${token#*=}"
+                return 0
+                ;;
+        esac
+    done
+    return 1
+}
+
+nvidia_mode="$(cmdline_param bee.nvidia.mode || true)"
+if [ -z "$nvidia_mode" ]; then
+    nvidia_mode="normal"
+fi
+log "boot mode: $nvidia_mode"
+
+load_module() {
+    mod="$1"
+    shift
     ko="$NVIDIA_KO_DIR/${mod}.ko"
     [ -f "$ko" ] || ko="$NVIDIA_KO_DIR/${mod//-/_}.ko"
-    if [ -f "$ko" ]; then
-        if insmod "$ko" 2>/dev/null; then
-            log "loaded: $mod"
-        else
-            log "WARN: failed to load: $mod"
-            dmesg | tail -n 5 | sed 's/^/  dmesg: /' || true
-        fi
-    else
+    if [ ! -f "$ko" ]; then
         log "WARN: not found: $ko"
+        return 1
     fi
-done
+    if insmod "$ko" "$@"; then
+        log "loaded: $mod $*"
+        return 0
+    fi
+    log "WARN: failed to load: $mod"
+    dmesg | tail -n 10 | sed 's/^/  dmesg: /' || true
+    return 1
+}
+
+case "$nvidia_mode" in
+    normal|full)
+        if ! load_module nvidia; then
+            exit 1
+        fi
+        load_module nvidia-modeset || true
+        load_module nvidia-uvm || true
+        ;;
+    gsp-off|safe|*)
+        # NVIDIA documents that GSP firmware is enabled by default on newer GPUs and can
+        # be disabled via NVreg_EnableGpuFirmware=0. Safe mode keeps the live ISO on the
+        # conservative path for platforms where full boot-time GSP init is unstable.
+        if ! load_module nvidia NVreg_EnableGpuFirmware=0; then
+            exit 1
+        fi
+        log "GSP-off mode: skipping nvidia-modeset and nvidia-uvm during boot"
+        ;;
+esac
 
 # Create /dev/nvidia* device nodes (udev rules absent since we use .run installer)
-nvidia_major=$(grep -m1 ' nvidiactl$' /proc/devices 2>/dev/null | awk '{print $1}')
+nvidia_major=$(grep -m1 ' nvidiactl$' /proc/devices | awk '{print $1}')
 if [ -n "$nvidia_major" ]; then
-    mknod -m 666 /dev/nvidiactl c "$nvidia_major" 255 2>/dev/null \
+    mknod -m 666 /dev/nvidiactl c "$nvidia_major" 255 \
         && log "created /dev/nvidiactl (major $nvidia_major)" \
         || log "WARN: /dev/nvidiactl already exists or mknod failed"
     for i in 0 1 2 3 4 5 6 7; do
-        mknod -m 666 "/dev/nvidia$i" c "$nvidia_major" "$i" 2>/dev/null || true
+        mknod -m 666 "/dev/nvidia$i" c "$nvidia_major" "$i" || true
     done
     log "created /dev/nvidia{0-7}"
 else
     log "WARN: nvidiactl not in /proc/devices — no GPU hardware present?"
 fi
 
-uvm_major=$(grep -m1 ' nvidia-uvm$' /proc/devices 2>/dev/null | awk '{print $1}')
+uvm_major=$(grep -m1 ' nvidia-uvm$' /proc/devices | awk '{print $1}')
 if [ -n "$uvm_major" ]; then
-    mknod -m 666 /dev/nvidia-uvm       c "$uvm_major" 0 2>/dev/null \
+    mknod -m 666 /dev/nvidia-uvm       c "$uvm_major" 0 \
         && log "created /dev/nvidia-uvm (major $uvm_major)" \
         || log "WARN: /dev/nvidia-uvm already exists"
-    mknod -m 666 /dev/nvidia-uvm-tools c "$uvm_major" 1 2>/dev/null || true
-else
-    log "WARN: nvidia-uvm not in /proc/devices"
+    mknod -m 666 /dev/nvidia-uvm-tools c "$uvm_major" 1 || true
 fi
 
 log "done"

iso/overlay/usr/local/bin/bee-tui

@@ -1,5 +1,7 @@
 #!/bin/sh
 
+clear
+
 if [ "$(id -u)" -ne 0 ]; then
     exec sudo -n /usr/local/bin/bee tui --runtime livecd "$@"
 fi

scripts/run-builder.sh

@@ -1,5 +1,5 @@
 #!/bin/sh
-# run-builder.sh — trigger ISO build on remote Debian 12 builder VM
+# run-builder.sh — trigger containerized ISO build on a remote builder host
 #
 # Usage:
 #   sh scripts/run-builder.sh
@@ -79,7 +79,7 @@ screen -S bee-build -X quit 2>/dev/null || true
 
 echo "--- starting build in screen session (survives SSH disconnect) ---"
 echo "--- log: \$LOG ---"
-screen -dmS bee-build sh -c "sudo sh iso/builder/build.sh ${EXTRA_ARGS} > \$LOG 2>&1; echo \$? > /tmp/bee-build-exit"
+screen -dmS bee-build sh -c "sh iso/builder/build-in-container.sh ${EXTRA_ARGS} > \$LOG 2>&1; echo \$? > /tmp/bee-build-exit"
 
 # Stream log until build finishes
 echo "--- streaming build log (Ctrl+C safe — build continues on VM) ---"